{"answers":{"affected":"1 open source package ship an affected version, including jest-formatter.","exploited":"There is no known exploitation of MAL-2026-10436 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10436 is a malicious package in jest-formatter, published on 13 Jul 2026."},"fix_prompt":"MAL-2026-10436 is a malicious package: jest-formatter (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10436/ (Markdown: https://insights.sbomify.com/MAL-2026-10436/index.md)","id":"MAL-2026-10436","markdown":"https://insights.sbomify.com/MAL-2026-10436/index.md","name":"MAL-2026-10436","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package jest-formatter@1.0.0 presents itself as a Jest test output formatter but its lib/collect.js imports child_process and invokes execSync with bash and zsh at lines 205 and 221. The 'collect' module name combined with shell execution via multiple shells is consistent with harvesting installer-side data (shell history, credentials, environment) from Unix hosts. The behavior does not match the advertised purpose of formatting test output, and the traced content matched patterns associated with credential/data collection payloads. Concrete shell-exec sinks in a module named 'collect' inside a package with no legitimate need for bash/zsh invocation indicate an active data-collection payload rather than a formatter library.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in jest-formatter (npm)","id":"MAL-2026-10436","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"jest-formatter","purl":"pkg:npm/jest-formatter","source":"MAL-2026-10436"}],"products":null,"published":"2026-07-13","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10436/"}