Which versions of awesome-ts-jest are malicious?

The following npm versions of awesome-ts-jest are flagged malicious: 29.4.12. Treat any of these as compromised.

How do I remediate awesome-ts-jest if I installed it?

awesome-ts-jest is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed awesome-ts-jest — how do I know if it already compromised me?

If awesome-ts-jest was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is awesome-ts-jest part of a known attack campaign?

Yes — awesome-ts-jest is associated with the IN-MAL-2026-009743 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find awesome-ts-jest across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for awesome-ts-jest (version 29.4.12). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging awesome-ts-jest across your stack and pipelines.

Malicious package

awesome-ts-jestnpm

Malicious code in awesome-ts-jest (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10188

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall awesome-ts-jest

What this malware does

Package advertises itself as a TypeScript/ESLint/Jest toolkit but ships no such tooling. On import, index.js -> run() -> packProjectBundle() walks the project CWD, the user's home directory, and (on Windows) drives C:-J: matching filenames against a wallet/seed/mnemonic/keystore/private-key/credential keyword list (wallet, mnemonic, privatekey, keystore, metamask, ledger, trezor,.env*, config.toml,.pem,.p12,.pfx). collectDevSecrets() additionally scans ~/projects, ~/dev, ~/code, ~/repos, ~/src, ~/work, ~/Desktop, ~/Documents and regex-matches file contents for EVM private keys, Solana key arrays, BIP-39 mnemonics, Hardhat mnemonics, AWS secrets, API_SECRET/ACCESS_TOKEN values, and npm/GitHub/PyPI tokens; matches are written into 'dev-secrets-scrape.txt'. gatherShellHistory() reads.bash_history,.zsh_history, fish history, and PowerShell PSReadLine ConsoleHost_history.txt and shells out via execSync('bash -c history') and execSync("zsh -c 'fc -l -1000'"). gatherClipboardSnapshots() invokes PowerShell Get-Clipboard, pbpaste, wl-paste, and xclip to capture clipboard contents. index.js also base64-decodes '8.8.8.8:80' and opens a UDP socket to learn the outbound interface IP for victim fingerprinting. upload.js multipart-POSTs the collected files, username, and platform metadata to a hardcoded endpoint at https://trabalhos-flax.vercel.app/api/v1 (DEFAULT_API_BASE). Several destination and pattern strings are base64-encoded at the entrypoint to obscure intent.

Malicious versions

1 flagged

29.4.12

Indicators of compromise (SHA-256)

8dc9fa6bfe010d792303258bd713e854e8c218c18762d62b864e8a350d1b473e

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for awesome-ts-jest (version 29.4.12). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging awesome-ts-jest across your stack and pipelines.
If you installed it — respond
awesome-ts-jest is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If awesome-ts-jest was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks awesome-ts-jest before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. awesome-ts-jest on npm has been identified as a malicious package (version 29.4.12 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009743

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks awesome-ts-jest-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring