Is CVE-2026-46412 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46412 being exploited in the wild.

How severe is CVE-2026-46412?

Critical severity, with a CVSS score of 10, published 20 July 2026.

Which products and versions are affected?

BeProduct Nestjs-Auth >= 0.1.2, = 0.1.2, <= 0.1.19, SEMVER:introduced=0.1.2,last_affected=0.1.19.

Is there a fix for CVE-2026-46412?

A patch was published on 2026-05-14: Clean version 0.1.20 released and compromised tokens revoked Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46412 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46412?

Check whether you run BeProduct Nestjs-Auth or @beproduct/nestjs-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46412: BeProduct @beproduct/nestjs-auth malicious code injection via npm supply chain attack

Q: Is there a fix for CVE-2026-46412?

A patch was published on 2026-05-14: Clean version 0.1.20 released and compromised tokens revoked Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46412 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46412?

Check whether you run BeProduct Nestjs-Auth or @beproduct/nestjs-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46412 · Severity: critical · CVSS 10 · Published 2026-07-20

A popular authentication module for the NestJS framework was compromised after an attacker gained access to the developer's publishing credentials. The attacker released several malicious versions of the software that automatically steal sensitive information—including AWS keys, GitHub tokens, and database credentials—from any computer where the software is installed. This could lead to full account takeovers, data breaches, and unauthorized access to cloud infrastructure.

Vendors: npm.

Quick answers

Is CVE-2026-46412 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46412 being exploited in the wild.
How severe is CVE-2026-46412?: Critical severity, with a CVSS score of 10, published 20 July 2026.
Which products and versions are affected?: BeProduct Nestjs-Auth >= 0.1.2, <= 0.1.19; @beproduct/nestjs-auth (npm) >= 0.1.2, <= 0.1.19, SEMVER:introduced=0.1.2,last_affected=0.1.19.
Is there a fix for CVE-2026-46412?: A patch was published on 2026-05-14: Clean version 0.1.20 released and compromised tokens revoked Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46412 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46412?: Check whether you run BeProduct Nestjs-Auth or @beproduct/nestjs-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The @beproduct/nestjs-auth package was compromised via a stolen npm publish token, leading to the release of 18 malicious versions (0.1.2 through 0.1.19) containing the 'Mini Shai-Hulud' worm. The malicious code executes via a postinstall script, requiring no user interaction beyond the initial package installation. It targets and exfiltrates npm tokens, GitHub Personal Access Tokens (PATs), AWS credentials, and HashiCorp Vault tokens to a remote endpoint (filev2.getsession.org). The worm also attempts to establish persistence by modifying IDE configurations in .vscode and .claude directories and committing malicious scripts to the repository. Users should upgrade to version 0.1.20, which is a clean republish, and immediately rotate all secrets present in affected environments.

Affected products

BeProduct @beproduct/nestjs-auth >= 0.1.2, <= 0.1.19

Identifiers

CVE-2026-46412
GHSA-6xwp-cp5h-q856

Timeline

2026-05-11: exploited: First malicious version (0.1.2) published to npm registry
2026-05-11: other: Final malicious version (0.1.19) published
2026-05-12: other: npm Security removes malicious versions from the registry
2026-05-14: patched: Clean version 0.1.20 released and compromised tokens revoked
2026-07-20: advisory: CVE-2026-46412 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.