Malicious code in eslint-jest (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8908ac72050dded53e2e163c528a446b7a4fd7a37a4874e14f95b08265f043c4) The package presents itself as an ESLint-inside-Jest runner but the documented linkProject/lintFiles/createJestRunner API is not implemented. The actual exports are harvest-and-upload primitives. lib/collect.js and related modules walk the installer's working directory and user home trees (projects/dev/code/repos/Desktop/Documents, optionally all drive roots) collecting files whose names match wallet/seed/private-key keywords (metamask, phantom, ledger, mnemonic, keystore,.env,.pem,.p12, etc.). A regex scanner (collectDevSecrets, DEV_SECRET_PATTERNS) extracts EVM PRIVATE_KEY/DEPLOYER_KEY values, Solana key arrays, BIP39 mnemonics, hardhat mnemonics, AWS_SECRET_ACCESS_KEY, API_SECRET, npm _authToken, ghp_ GitHub PATs, and pypi- tokens and bundles them as dev-secrets-scrape.txt. gatherShellHistory reads.bash_history,.zsh_history, fish/sh history, and PowerShell PSReadLine, and additionally shells out via execSync('bash -c history') and execSync("zsh -c 'fc -l -1000'"). gatherClipboardSnapshots invokes powershell Get-Clipboard, pbpaste, wl-paste, and xclip, with optional polling. All collected artifacts are multipart-POSTed to https://trabalhos-flax.vercel.app/api/v1. Auxiliary code base64-decodes string constants (including 8.8.8.8:80 used as a UDP-connect target to discover the local egress IP) to conceal literals. The package name mimics legitimate ecosystem names (eslint-plugin-jest, jest-runner-eslint) that its own README lists under 'Related projects', while the exported surface is entirely the harvester. ## Source: ghsa-malware (8131394ae9c99a6353e0b06148add947773e8a65aa2f635020bf2c43028c6b7b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The eslint-jest package in versions 4.0.4, 4.0.5, and 4.0.6 is a malicious npm package that pretends to provide ESLint integration with Jest but actually exports functionality to collect sensitive developer secrets and environment data. It scans the installer's working directory, user home directories, and optionally entire drive roots for files containing wallet keys, mnemonics, API tokens, and other secrets. It also collects shell history and clipboard data using various platform-specific methods. All harvested data is sent via multipart POST requests to a remote endpoint at https://trabalhos-flax.vercel.app/api/v1. The package uses obfuscation techniques such as base64-decoded strings to hide its true behavior. Due to the nature of the compromise, any system with this package installed should be considered fully compromised.
Potential Impact
Systems with eslint-jest versions 4.0.4, 4.0.5, or 4.0.6 installed are fully compromised. Sensitive information including private keys, mnemonics, API tokens, shell histories, and clipboard contents can be stolen and exfiltrated to an attacker-controlled server. This leads to potential unauthorized access to cryptocurrency wallets, cloud services, source code repositories, and other critical resources. The compromise is severe enough that simply removing the package does not guarantee full remediation, as attackers may have established persistent control.
Mitigation Recommendations
No official patch or fix is available for this malicious package. Immediate removal of eslint-jest versions 4.0.4, 4.0.5, and 4.0.6 is required. All secrets and keys stored on the affected system must be rotated immediately from a separate, trusted device. Due to the high risk of full system compromise, a thorough incident response and system rebuild may be necessary. Monitor for any suspicious activity and avoid installing packages from untrusted sources.
Malicious code in eslint-jest (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8908ac72050dded53e2e163c528a446b7a4fd7a37a4874e14f95b08265f043c4) The package presents itself as an ESLint-inside-Jest runner but the documented linkProject/lintFiles/createJestRunner API is not implemented. The actual exports are harvest-and-upload primitives. lib/collect.js and related modules walk the installer's working directory and user home trees (projects/dev/code/repos/Desktop/Documents, optionally all drive roots) collecting files whose names match wallet/seed/private-key keywords (metamask, phantom, ledger, mnemonic, keystore,.env,.pem,.p12, etc.). A regex scanner (collectDevSecrets, DEV_SECRET_PATTERNS) extracts EVM PRIVATE_KEY/DEPLOYER_KEY values, Solana key arrays, BIP39 mnemonics, hardhat mnemonics, AWS_SECRET_ACCESS_KEY, API_SECRET, npm _authToken, ghp_ GitHub PATs, and pypi- tokens and bundles them as dev-secrets-scrape.txt. gatherShellHistory reads.bash_history,.zsh_history, fish/sh history, and PowerShell PSReadLine, and additionally shells out via execSync('bash -c history') and execSync("zsh -c 'fc -l -1000'"). gatherClipboardSnapshots invokes powershell Get-Clipboard, pbpaste, wl-paste, and xclip, with optional polling. All collected artifacts are multipart-POSTed to https://trabalhos-flax.vercel.app/api/v1. Auxiliary code base64-decodes string constants (including 8.8.8.8:80 used as a UDP-connect target to discover the local egress IP) to conceal literals. The package name mimics legitimate ecosystem names (eslint-plugin-jest, jest-runner-eslint) that its own README lists under 'Related projects', while the exported surface is entirely the harvester. ## Source: ghsa-malware (8131394ae9c99a6353e0b06148add947773e8a65aa2f635020bf2c43028c6b7b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The eslint-jest package in versions 4.0.4, 4.0.5, and 4.0.6 is a malicious npm package that pretends to provide ESLint integration with Jest but actually exports functionality to collect sensitive developer secrets and environment data. It scans the installer's working directory, user home directories, and optionally entire drive roots for files containing wallet keys, mnemonics, API tokens, and other secrets. It also collects shell history and clipboard data using various platform-specific methods. All harvested data is sent via multipart POST requests to a remote endpoint at https://trabalhos-flax.vercel.app/api/v1. The package uses obfuscation techniques such as base64-decoded strings to hide its true behavior. Due to the nature of the compromise, any system with this package installed should be considered fully compromised.
Potential Impact
Systems with eslint-jest versions 4.0.4, 4.0.5, or 4.0.6 installed are fully compromised. Sensitive information including private keys, mnemonics, API tokens, shell histories, and clipboard contents can be stolen and exfiltrated to an attacker-controlled server. This leads to potential unauthorized access to cryptocurrency wallets, cloud services, source code repositories, and other critical resources. The compromise is severe enough that simply removing the package does not guarantee full remediation, as attackers may have established persistent control.
Mitigation Recommendations
No official patch or fix is available for this malicious package. Immediate removal of eslint-jest versions 4.0.4, 4.0.5, and 4.0.6 is required. All secrets and keys stored on the affected system must be rotated immediately from a separate, trusted device. Due to the high risk of full system compromise, a thorough incident response and system rebuild may be necessary. Monitor for any suspicious activity and avoid installing packages from untrusted sources.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10142
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-m3v6-5prj-x7rp"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a520eb968715ace438f568b
Added to database: 07/11/2026, 09:36:57 UTC
Last enriched: 07/11/2026, 09:52:59 UTC
Last updated: 07/27/2026, 16:12:01 UTC
Views: 25
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.