registry / @ornikar/jest-config-react / 18.0.7

@ornikar/jest-config-react@18.0.7

✅⚛️ jest config for react

AI Security Review

scanned 11d ago · by lpm-firewall-ai

npm preinstall executes an obfuscated secondary payload. The payload can retrieve and eval remote code.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install

Impact

Arbitrary code execution during dependency installation.

Mechanism

downloaded runtime launches obfuscated remote-code loader

Attack narrative

On installation, package.json runs setup.mjs. It downloads or invokes Bun and uses it to execute the bundled, obfuscated math_init.js. That payload contains network-response eval and process-execution capabilities, creating an install-time remote code execution chain unrelated to the package's declared Jest configuration.

Rationale

The install hook creates a concrete, concealed remote-code execution path. This behavior is incompatible with a Jest config package.

Evidence

package.jsonsetup.mjsmath_init.js

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

@ornikar/jest-config-react@18.0.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code