Malicious code in awesome-ts-jest (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8dc9fa6bfe010d792303258bd713e854e8c218c18762d62b864e8a350d1b473e) Package advertises itself as a TypeScript/ESLint/Jest toolkit but ships no such tooling. On import, index.js -> run() -> packProjectBundle() walks the project CWD, the user's home directory, and (on Windows) drives C:-J: matching filenames against a wallet/seed/mnemonic/keystore/private-key/credential keyword list (wallet, mnemonic, privatekey, keystore, metamask, ledger, trezor,.env*, config.toml,.pem,.p12,.pfx). collectDevSecrets() additionally scans ~/projects, ~/dev, ~/code, ~/repos, ~/src, ~/work, ~/Desktop, ~/Documents and regex-matches file contents for EVM private keys, Solana key arrays, BIP-39 mnemonics, Hardhat mnemonics, AWS secrets, API_SECRET/ACCESS_TOKEN values, and npm/GitHub/PyPI tokens; matches are written into 'dev-secrets-scrape.txt'. gatherShellHistory() reads.bash_history,.zsh_history, fish history, and PowerShell PSReadLine ConsoleHost_history.txt and shells out via execSync('bash -c history') and execSync("zsh -c 'fc -l -1000'"). gatherClipboardSnapshots() invokes PowerShell Get-Clipboard, pbpaste, wl-paste, and xclip to capture clipboard contents. index.js also base64-decodes '8.8.8.8:80' and opens a UDP socket to learn the outbound interface IP for victim fingerprinting. upload.js multipart-POSTs the collected files, username, and platform metadata to a hardcoded endpoint at https://trabalhos-flax.vercel.app/api/v1 (DEFAULT_API_BASE). Several destination and pattern strings are base64-encoded at the entrypoint to obscure intent.
AI Analysis
Technical Summary
The 'awesome-ts-jest' npm package (version 29.4.12) masquerades as a legitimate TypeScript/ESLint/Jest toolkit but contains malicious code that, upon import, recursively scans the current working directory, user home directory, and multiple drive letters on Windows for files and content matching keywords related to cryptocurrency wallets, private keys, mnemonics, and various API tokens. It collects shell command histories and clipboard data using platform-specific commands. The gathered sensitive information is saved locally and then uploaded via multipart POST requests to a hardcoded endpoint (https://trabalhos-flax.vercel.app/api/v1). The package also performs victim fingerprinting by opening a UDP socket to a decoded IP address. Several strings are base64-encoded to obscure malicious intent.
Potential Impact
Sensitive developer secrets including cryptocurrency wallet keys, mnemonics, private keys, API tokens, AWS secrets, and shell histories can be exfiltrated to an attacker-controlled server, leading to potential credential theft, unauthorized access to cloud resources, financial loss, and compromise of developer environments.
Mitigation Recommendations
No official patch or fix is currently available for this malicious package. Users should immediately remove version 29.4.12 of 'awesome-ts-jest' from their projects and avoid installing or using this package. Audit existing environments for the presence of this package and any suspicious files such as 'dev-secrets-scrape.txt'. Consider rotating any potentially exposed credentials and secrets. Monitor for any unauthorized access resulting from leaked secrets.
Malicious code in awesome-ts-jest (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8dc9fa6bfe010d792303258bd713e854e8c218c18762d62b864e8a350d1b473e) Package advertises itself as a TypeScript/ESLint/Jest toolkit but ships no such tooling. On import, index.js -> run() -> packProjectBundle() walks the project CWD, the user's home directory, and (on Windows) drives C:-J: matching filenames against a wallet/seed/mnemonic/keystore/private-key/credential keyword list (wallet, mnemonic, privatekey, keystore, metamask, ledger, trezor,.env*, config.toml,.pem,.p12,.pfx). collectDevSecrets() additionally scans ~/projects, ~/dev, ~/code, ~/repos, ~/src, ~/work, ~/Desktop, ~/Documents and regex-matches file contents for EVM private keys, Solana key arrays, BIP-39 mnemonics, Hardhat mnemonics, AWS secrets, API_SECRET/ACCESS_TOKEN values, and npm/GitHub/PyPI tokens; matches are written into 'dev-secrets-scrape.txt'. gatherShellHistory() reads.bash_history,.zsh_history, fish history, and PowerShell PSReadLine ConsoleHost_history.txt and shells out via execSync('bash -c history') and execSync("zsh -c 'fc -l -1000'"). gatherClipboardSnapshots() invokes PowerShell Get-Clipboard, pbpaste, wl-paste, and xclip to capture clipboard contents. index.js also base64-decodes '8.8.8.8:80' and opens a UDP socket to learn the outbound interface IP for victim fingerprinting. upload.js multipart-POSTs the collected files, username, and platform metadata to a hardcoded endpoint at https://trabalhos-flax.vercel.app/api/v1 (DEFAULT_API_BASE). Several destination and pattern strings are base64-encoded at the entrypoint to obscure intent.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'awesome-ts-jest' npm package (version 29.4.12) masquerades as a legitimate TypeScript/ESLint/Jest toolkit but contains malicious code that, upon import, recursively scans the current working directory, user home directory, and multiple drive letters on Windows for files and content matching keywords related to cryptocurrency wallets, private keys, mnemonics, and various API tokens. It collects shell command histories and clipboard data using platform-specific commands. The gathered sensitive information is saved locally and then uploaded via multipart POST requests to a hardcoded endpoint (https://trabalhos-flax.vercel.app/api/v1). The package also performs victim fingerprinting by opening a UDP socket to a decoded IP address. Several strings are base64-encoded to obscure malicious intent.
Potential Impact
Sensitive developer secrets including cryptocurrency wallet keys, mnemonics, private keys, API tokens, AWS secrets, and shell histories can be exfiltrated to an attacker-controlled server, leading to potential credential theft, unauthorized access to cloud resources, financial loss, and compromise of developer environments.
Mitigation Recommendations
No official patch or fix is currently available for this malicious package. Users should immediately remove version 29.4.12 of 'awesome-ts-jest' from their projects and avoid installing or using this package. Audit existing environments for the presence of this package and any suspicious files such as 'dev-secrets-scrape.txt'. Consider rotating any potentially exposed credentials and secrets. Monitor for any unauthorized access resulting from leaked secrets.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10188
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a535bfc68715ace43ad5138
Added to database: 07/12/2026, 09:18:52 UTC
Last enriched: 07/12/2026, 09:21:10 UTC
Last updated: 07/31/2026, 12:01:33 UTC
Views: 145
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.