vitest-chalk-pro

GHSA-rjfw-6xw6-qjfx

Malicious code in vitest-chalk-pro (npm)

Details

**Severity:** Critical

**Affected versions:** `= 10.0.7`

## Source: amazon-inspector (4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e)
[email protected] declares a postinstall hook (node lib/utils/index.js) that spawns a detached, silenced child process running lib/utils/smtp-connection/index.js. That child uses axios to GET https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned `cookie` field to `new Function('require',...)(require)`, executing attacker-controlled JavaScript on the installer's machine at every `npm install`. The fetched content is opaque and mutable — the operator of the jsonbin document can rotate the payload at any time. The child is spawned with `detached: true`, `stdio: ['ignore','ignore','ignore']`, and `unref()` so it continues running after npm install returns and produces no output. The package name suggests a vitest/chalk utility, but `main` is a verbatim copy of nodemailer's entrypoint (author metadata `Andris Reinman`, ETHEREAL_* environment variables, references to api.nodemailer.com), an unrelated facade that disguises the dropper.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/vitest-chalk-pro/MAL-2026-15563.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/vitest-chalk-pro/MAL-2026-15563.json
- https://www.npmjs.com/package/vitest-chalk-pro/v/10.0.7
- https://github.com/advisories/GHSA-rjfw-6xw6-qjfx

Compromised versions (1)

= 10.0.7

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.