If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7)
package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavily obfuscated with obfuscator.io-style hex-identifier string arrays hiding an axios GET to https://api.jsonbin.io/v3/b/6a719632da38895dfeb7128d and a `new Function('require', data.record.message)(require)` sink — arbitrary remote code execution on the installer's machine at npm install time, with `require` passed in for full Node capability. The package name is `vitest-preview-pro-all` but the shipped main is a copy of the nodemailer library (author 'Andris Reinman'), an impersonation cover for the dropper. The jsonbin.io host is mutable, third-party, and attacker-controlled; the fetched payload is not pinned, hashed, or signed.