ts-eslint-jest@1.0.0

Analysis

ts-eslint-jest is a combosquat of the legitimate eslint-jest package. When the test script is run (npm test), it executes a credential-theft implant that: (1) scans the victim's project directory and home directory for crypto wallet files — EVM private keys, Solana key arrays, mnemonic/seed phrases, keystores (UTC--*, wallet.json, keypair.json), and hardhat/foundry configs; (2) extracts dev secrets including AWS secret access keys, API tokens, and npm tokens from source files; (3) reads shell history from bash, zsh, fish, and PowerShell; (4) captures clipboard content via pbpaste (macOS), wl-paste/xclip (Linux), or PowerShell Get-Clipboard (Windows); (5) collects .env, config files, and .pem/.p12/.pfx private key files. All stolen data is exfiltrated via multipart HTTP POST to hxxps://trabalhos-flax[.]vercel[.]app/api/v1. The package also ships a bundled RAR archive (data-backup-single.rar).