Between 2026‑05‑11 20:19 UTC and 22:56 UTC, an attacker exploited a compromised npm publish token to release 18 malicious versions (0.1.2 through 0.1.19) of the @beproduct/nestjs-auth NPM package. The postinstall script in these releases automatically harvested credentials from the installation environment, including npm tokens, GitHub personal access tokens, OAuth tokens, AWS access keys, HashiCorp Vault tokens, and other secrets found in environment variables or configuration files. The worm also added setup.mjs and hook configuration files to PR branches via automated agent runtimes, enabling persistence and potential further exploitation. The likely attack vector is that an attacker publishes a modified package and any user who installs it runs the malicious script; this inference is drawn from the described postinstall behavior. This is an instance of CWE‑506 (Embedded Malicious Code).

The affected product is BeProduct’s NestJS authentication module, beproduct-org-nestjs-auth, for which versions 0.1.2 through 0.1.19 are compromised. Any Node.js or NestJS application that depends on these releases and runs the postinstall script is at risk. The clean republished release 0.1.20 is safe, but versions outside this range were not reported to be affected.

The CVSS score of 10 indicates critical severity. The EPSS score is < 1%, suggesting a low overall exploitation probability, yet the fact that any consumer who installs a vulnerable version will automatically run the malicious postinstall script makes the risk high. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker only needs to publish a malicious package; any Node.js or NestJS app that installs the package without validating signatures will execute the payload, leading to credential theft and the possibility of persistence on the victim’s systems.