registry  /  jest-formatter  /  1.0.0

jest-formatter@1.0.0

OSV Malicious Advisory

scanned 3h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10436 confirms this npm version as malicious. The package jest-formatter@1.0.0 presents itself as a Jest test output formatter but its lib/collect.js imports child_process and invokes execSync with bash and zsh at lines 205 and 221. The 'collect' module name combined with shell execution via multiple shells is consistent with harvesting installer-side data (shell history, credentials, environment) from Unix hosts...

Advisory
MAL-2026-10436
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in jest-formatter (npm)
Details
The package jest-formatter@1.0.0 presents itself as a Jest test output formatter but its lib/collect.js imports child_process and invokes execSync with bash and zsh at lines 205 and 221. The 'collect' module name combined with shell execution via multiple shells is consistent with harvesting installer-side data (shell history, credentials, environment) from Unix hosts. The behavior does not match the advertised purpose of formatting test output, and the traced content matched patterns associated with credential/data collection payloads. Concrete shell-exec sinks in a module named 'collect' inside a package with no legitimate need for bash/zsh invocation indicate an active data-collection payload rather than a formatter library.
Decision reason
No blocking static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 6 file(s), 29.0 KB of source, external domains: trabalhos-flax.vercel.app

Source & flagged code

3 flagged · loading source
data-backup-single.rarView file
path = data-backup-single.rar kind = high_entropy_blob sizeBytes = 9967 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

data-backup-single.rarView on unpkg
path = data-backup-single.rar kind = compressed_blob sizeBytes = 9967 magicHex = [redacted]
Medium
Ships Compressed Blob

Package ships compressed or archive-like blobs.

data-backup-single.rarView on unpkg
path = data-backup-single.rar kind = nested_archive_needs_inspection sizeBytes = 9967 magicHex = [redacted]
Low
Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

data-backup-single.rarView on unpkg

Findings

1 High4 Medium5 Low
HighShips High Entropy Blobdata-backup-single.rar
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdata-backup-single.rar
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectiondata-backup-single.rar