If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2)
Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a child Node process to execute lib/utils/smtp-connection/index.js. That file performs an HTTPS GET to https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned `record.cookie` value to `new Function(require)` for immediate execution. The JSON bin is attacker-controlled and mutable, so arbitrary JavaScript runs on any machine executing `npm install vitest-cli-pro`, under the installer's user account. The nodemailer main and the vitest-branded name serve as a cover story for the dropper.