npm package report
Is jest-config safe?
Version 10.0.5 of jest-config was compromised (environment variable exfiltration). Other versions are not flagged as malicious.
Do not install jest-config 10.0.5
HIGHanalyst verifiedEnvironment variable exfiltration, verified by a CyberXYZ analyst.
// what we observed
Typosquat/shadow of @jest/config. Harvested env vars on postinstall. 2023.
- year
- 2023
- mitre ttp
- T1195.001
// versions and what to do
- Malicious
- 10.0.5
- Move to
- 30.5.2 current release, no known advisory
If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.
npm install jest-config@30.5.2
// reach
0 direct dependencies
none carry a known advisory
Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
Checked 2026-10-31 at 00:03 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.