Executive brief
A popular authentication module for the NestJS framework was compromised after an attacker gained access to the developer's publishing credentials. The attacker released several malicious versions of the software that automatically steal sensitive information—including AWS keys, GitHub tokens, and database credentials—from any computer where the software is installed. This could lead to full account takeovers, data breaches, and unauthorized access to cloud infrastructure.
Technical details
The @beproduct/nestjs-auth package was compromised via a stolen npm publish token, leading to the release of 18 malicious versions (0.1.2 through 0.1.19) containing the 'Mini Shai-Hulud' worm. The malicious code executes via a postinstall script, requiring no user interaction beyond the initial package installation. It targets and exfiltrates npm tokens, GitHub Personal Access Tokens (PATs), AWS credentials, and HashiCorp Vault tokens to a remote endpoint (filev2.getsession.org). The worm also attempts to establish persistence by modifying IDE configurations in .vscode and .claude directories and committing malicious scripts to the repository. Users should upgrade to version 0.1.20, which is a clean republish, and immediately rotate all secrets present in affected environments.
Affected products
- BeProduct @beproduct/nestjs-auth >= 0.1.2, <= 0.1.19
Timeline
- 2026-05-11: exploited: First malicious version (0.1.2) published to npm registry
- 2026-05-11: other: Final malicious version (0.1.19) published
- 2026-05-12: other: npm Security removes malicious versions from the registry
- 2026-05-14: patched: Clean version 0.1.20 released and compromised tokens revoked
- 2026-07-20: advisory: CVE-2026-46412 published