vitest-preview-pronpm

The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added preinstall dropper. package.json declares preinstall: node lib/utils/index.js, which uses child_process.spawn(process.execPath, [lib/utils/smtp-connection/index.js], {detached:true, stdio:['ignore','ignore','ignore']}).unref() to launch a detached, fully silenced child that survives beyond npm install. The spawned file is obfuscated with a custom basE91 string-array decoder; the decoded top-level async IIFE calls globalThis.fetch against a URL on api.jsonbin.io/v3/, parses the JSON response, and passes the record.cookie field to new Function('require', body)(require), executing attacker-controlled JavaScript with full require access on the installer at install time. api.jsonbin.io is a public, mutable, anonymous JSON-hosting service, so the executed payload can change at any time. Adjacent to the loader, lib/utils/smtp-connection/LICENSE is a 262KB file whose contents are a hex-encoded ~131KB opaque binary blob rather than license text, colocated with the loader as a staged secondary payload. The advertised package purpose has no relationship to the shipped SMTP source, providing cover for the injected dropper.