MAL-2026-13627

Dashboard / Malicious Package / MAL-2026-13627

MAL-2026-13627

Summary: Malicious code in @nestjs-passport/jwt (npm)

Details: Source: amazon-inspector (0d3060c9289c475e223c1c00bc21a0f59f8aa5b18e31bfaee6e4d923eab0042f) Package published under the @nestjs-passport scope, which resembles the official @nestjs/jwt and @nestjs/passport packages. The sole entrypoint files dist/index.cjs and dist/index.js each consist of a single-line JSFuck-encoded string (~2.3MB of permutations of!+[],!![], +[]) that is passed to new Function('jose', <opaque body>) and invoked at require/import time, executing hidden code in the installer's Node process every time the module is loaded. The advertised purpose is a minimal HS256 JWT helper — a task requiring only a few lines of jose calls — and the shipped TypeScript declarations expose obfuscated private field names such as _0x5f2e and _0x4b19, inconsistent with the declared tsup build tooling. The combination of scope-level typosquat, whole-module JSFuck obfuscation, and dynamic evaluation of the obfuscated body at import time is a concealment-and-execution vehicle: whatever behavior the payload performs runs inside the installer's process without any traced-readable code path.

References: https://www.npmjs.com/package/@nestjs-passport/jwt/v/1.0.7, https://www.npmjs.com/package/@nestjs-passport/jwt/v/1.0.4