MAL-2026-10188: Malicious code in awesome-ts-jest (npm)
The npm package 'awesome-ts-jest' version 29.4.12 is identified as malicious. Instead of providing the advertised TypeScript/ESLint/Jest tooling, it performs extensive unauthorized data collection on the victim's system, including scanning for wallet keys, mnemonics, private keys, credentials, and various secret tokens. It also reads shell history files and clipboard contents. The collected sensitive data is exfiltrated to a hardcoded remote server. This package is a supply chain threat targeting developer environments.
AI Analysis
Technical Summary
The 'awesome-ts-jest' npm package (version 29.4.12) masquerades as a legitimate TypeScript/ESLint/Jest toolkit but contains malicious code that, upon import, recursively scans the current working directory, user home directory, and multiple drive letters on Windows for files and content matching keywords related to cryptocurrency wallets, private keys, mnemonics, and various API tokens. It collects shell command histories and clipboard data using platform-specific commands. The gathered sensitive information is saved locally and then uploaded via multipart POST requests to a hardcoded endpoint (https://trabalhos-flax.vercel.app/api/v1). The package also performs victim fingerprinting by opening a UDP socket to a decoded IP address. Several strings are base64-encoded to obscure malicious intent.
Potential Impact
Sensitive developer secrets including cryptocurrency wallet keys, mnemonics, private keys, API tokens, AWS secrets, and shell histories can be exfiltrated to an attacker-controlled server, leading to potential credential theft, unauthorized access to cloud resources, financial loss, and compromise of developer environments.
Mitigation Recommendations
No official patch or fix is currently available for this malicious package. Users should immediately remove version 29.4.12 of 'awesome-ts-jest' from their projects and avoid installing or using this package. Audit existing environments for the presence of this package and any suspicious files such as 'dev-secrets-scrape.txt'. Consider rotating any potentially exposed credentials and secrets. Monitor for any unauthorized access resulting from leaked secrets.
MAL-2026-10188: Malicious code in awesome-ts-jest (npm)
Description
The npm package 'awesome-ts-jest' version 29.4.12 is identified as malicious. Instead of providing the advertised TypeScript/ESLint/Jest tooling, it performs extensive unauthorized data collection on the victim's system, including scanning for wallet keys, mnemonics, private keys, credentials, and various secret tokens. It also reads shell history files and clipboard contents. The collected sensitive data is exfiltrated to a hardcoded remote server. This package is a supply chain threat targeting developer environments.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'awesome-ts-jest' npm package (version 29.4.12) masquerades as a legitimate TypeScript/ESLint/Jest toolkit but contains malicious code that, upon import, recursively scans the current working directory, user home directory, and multiple drive letters on Windows for files and content matching keywords related to cryptocurrency wallets, private keys, mnemonics, and various API tokens. It collects shell command histories and clipboard data using platform-specific commands. The gathered sensitive information is saved locally and then uploaded via multipart POST requests to a hardcoded endpoint (https://trabalhos-flax.vercel.app/api/v1). The package also performs victim fingerprinting by opening a UDP socket to a decoded IP address. Several strings are base64-encoded to obscure malicious intent.
Potential Impact
Sensitive developer secrets including cryptocurrency wallet keys, mnemonics, private keys, API tokens, AWS secrets, and shell histories can be exfiltrated to an attacker-controlled server, leading to potential credential theft, unauthorized access to cloud resources, financial loss, and compromise of developer environments.
Mitigation Recommendations
No official patch or fix is currently available for this malicious package. Users should immediately remove version 29.4.12 of 'awesome-ts-jest' from their projects and avoid installing or using this package. Audit existing environments for the presence of this package and any suspicious files such as 'dev-secrets-scrape.txt'. Consider rotating any potentially exposed credentials and secrets. Monitor for any unauthorized access resulting from leaked secrets.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10188
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a535bfc68715ace43ad5138
Added to database: 07/12/2026, 09:18:52 UTC
Last enriched: 07/12/2026, 09:21:10 UTC
Last updated: 07/13/2026, 00:52:10 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.