jest-formatter

{"modified":"2026-07-13T09:22:35Z","published":"2026-07-13T09:22:35Z","schema_version":"1.7.4","id":"MAL-2026-10436","summary":"Malicious code in jest-formatter (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (af1f270f7df9ee4f9088044964921e1b085b809ddb1d696e652326c58e5c0aba)\nThe package jest-formatter@1.0.0 presents itself as a Jest test output formatter but its lib/collect.js imports child_process and invokes execSync with bash and zsh at lines 205 and 221. The 'collect' module name combined with shell execution via multiple shells is consistent with harvesting installer-side data (shell history, credentials, environment) from Unix hosts. The behavior does not match the advertised purpose of formatting test output, and the traced content matched patterns associated with credential/data collection payloads. Concrete shell-exec sinks in a module named 'collect' inside a package with no legitimate need for bash/zsh invocation indicate an active data-collection payload rather than a formatter library.\n","affected":[{"package":{"ecosystem":"npm","name":"jest-formatter"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/collect.js","sha256":"3bba21021a32cdcfa653be8f1f09a827af8c442780813af584cd555ee2765de0","tlsh":"ac82d7c910f972298bf2a3b9db170015fe6b4963d4068399fefc8a842f76110d265dec"}],"package_integrity":[{"filename":"jest-formatter-1.0.0.tgz","hashes":{"sha1":"f26e69f6520ad42c28158bc9bfed1d077d8de017","sha512_sri":"sha512-9HsDqEL0hYNdDnXfu6/yY8aV35mNKMBmAbJM3E9c9zQ2MD0wfjc3/RWMFRtNMs5xvfiojkWC++ad6e5oPTfB0w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/jest-formatter/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010208","import_time":"2026-07-13T10:37:37.841992243Z","modified_time":"2026-07-13T09:22:35Z","sha256":"af1f270f7df9ee4f9088044964921e1b085b809ddb1d696e652326c58e5c0aba","source":"amazon-inspector","versions":["1.0.0"]}]}}