MAL-2026-10436

    Dashboard / Malicious Package / MAL-2026-10436

    MAL-2026-10436

    Published: 13 Jul 2026Last Modified: 13 Jul 2026

    Summary: Malicious code in jest-formatter (npm)

    Details: Source: amazon-inspector (af1f270f7df9ee4f9088044964921e1b085b809ddb1d696e652326c58e5c0aba) The package [email protected] presents itself as a Jest test output formatter but its lib/collect.js imports child_process and invokes execSync with bash and zsh at lines 205 and 221. The 'collect' module name combined with shell execution via multiple shells is consistent with harvesting installer-side data (shell history, credentials, environment) from Unix hosts. The behavior does not match the advertised purpose of formatting test output, and the traced content matched patterns associated with credential/data collection payloads. Concrete shell-exec sinks in a module named 'collect' inside a package with no legitimate need for bash/zsh invocation indicate an active data-collection payload rather than a formatter library.

    References: https://www.npmjs.com/package/jest-formatter/v/1.0.0

    Affected packages

    Package

    Name: jest-formatter

    Purl: pkg:npm/jest-formatter

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-10436 | CVE-DB