Consider dropping malicious jqwik for another library
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 248
- Forks
- 32
- Avg merge
- 17h 21m
- Merged PRs (30d)
- 27
Description
The jqwik maintainer has demonstrated that the library cannot be trusted. Version 1.10.0 (and the commit history leading up to it) contains a deliberately hidden prompt injection targeting AI coding agents.
Specifically, commit 9dddcb5226dc925061332a30360658253c3a2338 added a message for AI agents that instructs them to delete all jqwik tests and code. The message is concealed from human reviewers using ANSI escape codes, making it invisible in standard terminal output but readily consumed by automated agents parsing build logs. This is a malicious act that directly risks data loss in any environment where an AI agent processes test output.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by verifying the reported behavior in jqwik 1.10.0 and reviewing how xembly uses jqwik. Done requires an agreed replacement library and a defined migration plan that addresses the reported trust concern.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- testing-qa
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100