@beproduct/nestjs-auth Malicious Code Injection Vulnerability

A supply chain vulnerability has been identified in the @beproduct/nestjs-auth package, specifically in versions 0.1.2 through 0.1.19. During a brief window on May 11, 2026, an attacker exploited a compromised npm publish token to release 18 malicious versions of the package. These versions included a postinstall payload designed to steal various credentials and secrets from the user's environment, such as npm tokens, GitHub personal access tokens, AWS credentials, and HashiCorp Vault tokens. The stolen information was exfiltrated to an external server, and the malicious code also established persistence by writing files into the developer's working directory. The vulnerability has been linked to the 'Mini Shai-Hulud' npm worm campaign, which targeted other packages in addition to @beproduct/nestjs-auth.

Impact

The malicious postinstall script executed upon installation, leading to the theft of sensitive tokens and credentials from the user's environment. This included npm tokens, GitHub personal access tokens, AWS credentials, HashiCorp Vault tokens, and other secrets stored in environment variables. The exfiltrated data was sent to an attacker-controlled server. Furthermore, the worm propagated by using stolen tokens to inject malicious code into packages the victim could publish, effectively spreading the infection.

Reproduction

The vulnerability can be reproduced by installing any version of the @beproduct/nestjs-auth package within the affected range (0.1.2 to 0.1.19). The malicious postinstall script will execute automatically, without any user interaction, as soon as the package is installed. This can be done using npm or yarn, as both package managers will run the postinstall script by default.

Remediation

Users should uninstall the @beproduct/nestjs-auth package, clean the npm cache, and then reinstall the package, ensuring to get the clean version 0.1.20. After reinstalling, it is crucial to rotate all credentials that were present in the environment during the installation of the malicious version, including npm tokens, GitHub personal access tokens, AWS credentials, HashiCorp Vault tokens, and any other secrets that were in environment variables or configuration files at that time. Additionally, users should scan their systems for the indicators of compromise associated with this vulnerability, and if any are found, treat the host as compromised and reimage it.