A malicious release of @beproduct/nestjs-auth between 0.1.2 and 0.1.19 introduced a postinstall payload that automatically harvested a wide array of credentials from the installation environment, including NPM tokens, GitHub personal access tokens, OAuth tokens, AWS credentials, and HashiCorp Vault tokens. This breach provides an attacker with direct access to sensitive authentication information and may enable further exploitation of the victim’s systems. The postinstall hook was triggered as part of the standard package installation process, making the attack vector likely to be a compromised npm publish token used by the attacker. The capability to exfiltrate secrets and modify project files also opens the door to persistent malicious code insertion and potential remote code execution on vulnerable machines.

The affected product is BeProduct’s NestJS authentication module, beproduct-org-nestjs-auth, for which versions 0.1.2 through 0.1.19 are compromised. Any Node.js or NestJS application that depends on these releases and runs the postinstall script is at risk. The clean republished release 0.1.20 is safe, but versions outside this range were not reported to be affected.

The CVSS score of 10 indicates critical severity, and although the EPSS score is undisclosed, the lack of listing in CISA’s KEV catalog does not reduce the threat. An attacker only needs to publish a malicious package to the npm registry and any unscrupulous consumer who installs a vulnerable version will automatically run the payload. The damage may span credential theft, data leakage, and the introduction of backdoors or other malware, all of which can be exploited if the compromised credentials are used to access downstream services. The attack vector is inferred to be the standard npm dependency installation process, which, if not validated, allows the malicious code to run without additional privileges.