registry / Remote code execution / vitest-preview-pro
vitest-preview-pro
Copyright (c) React Training 2015-present
This report shows the evidence for vitest-preview-pro@10.0.3. 4 of 5 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has a concrete obfuscated, detached preinstall payload loader rather than package-aligned functionality. Its remote code execution path is directly established from source.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm preinstall
Impact
Arbitrary code execution on the installing machine.
Mechanism
detached remote payload fetch and Function-based execution
Attack narrative
During npm preinstall, lib/utils/index.js spawns and detaches a Node process for an obfuscated file. That file constructs Function dynamically, fetches an embedded api.jsonbin.io URL, and executes the remotely supplied code with require available. This is unconsented install-time remote code execution.
AI rationale
The package has a concrete obfuscated, detached preinstall payload loader rather than package-aligned functionality. Its remote code execution path is directly established from source.
Evidence
package.jsonlib/utils/index.jslib/utils/smtp-connection/index.js
Network endpoints1
api.jsonbin.io/v3/b/6a709899da38895dfeb3bc72
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs preinstall: node lib/utils/index.js.
- lib/utils/index.js detaches a child Node process for lib/utils/smtp-connection/index.js.
- That child is heavily obfuscated and dynamically constructs code via Function.
- Decoded embedded URL is https://api.jsonbin.io/v3/b/6a709899da38895dfeb3bc72.
- Obfuscated loader fetches remote content and passes require into dynamically created code.
Evidence against
- lib/nodemailer.js and lib/shared/index.js otherwise resemble mail-library source.
- No legitimate need is shown for the preinstall background loader.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node lib/utils/index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/smtp-connection/index.jsView file
2L3: const packageInfo = require('../../package.json');
L4: const EventEmitter = require('events').EventEmitter;
L5: const net = require('net');
L6: const tls = require('tls');
...
L49:
L50: this.id = crypto.randomBytes(8).toString('base64').replace(/\W/g, '');
L51: this.stage = 'init';
...
L69:
L70: this.name = this.options.name || this._getHostname();
L71:
...
L637: } else {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/smtp-connection/index.jsView on unpkg · L2lib/shared/index.jsView file
Findings
2 High3 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritylib/shared/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptolib/smtp-connection/index.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to vitest-preview-pro@10.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing vitest-preview-pro@10.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.