The eslint-jest package in versions 4.0.4, 4.0.5, and 4.0.6 is a malicious npm package that pretends to provide ESLint integration with Jest but actually exports functionality to collect sensitive developer secrets and environment data. It scans the installer's working directory, user home directories, and optionally entire drive roots for files containing wallet keys, mnemonics, API tokens, and other secrets. It also collects shell history and clipboard data using various platform-specific methods. All harvested data is sent via multipart POST requests to a remote endpoint at https://trabalhos-flax.vercel.app/api/v1. The package uses obfuscation techniques such as base64-decoded strings to hide its true behavior. Due to the nature of the compromise, any system with this package installed should be considered fully compromised.

Systems with eslint-jest versions 4.0.4, 4.0.5, or 4.0.6 installed are fully compromised. Sensitive information including private keys, mnemonics, API tokens, shell histories, and clipboard contents can be stolen and exfiltrated to an attacker-controlled server. This leads to potential unauthorized access to cryptocurrency wallets, cloud services, source code repositories, and other critical resources. The compromise is severe enough that simply removing the package does not guarantee full remediation, as attackers may have established persistent control.

No official patch or fix is available for this malicious package. Immediate removal of eslint-jest versions 4.0.4, 4.0.5, and 4.0.6 is required. All secrets and keys stored on the affected system must be rotated immediately from a separate, trusted device. Due to the high risk of full system compromise, a thorough incident response and system rebuild may be necessary. Monitor for any suspicious activity and avoid installing packages from untrusted sources.