CVE-2026-46412
Received Received - Intake

Malicious Package in @beproduct/nestjs-auth Harvesting Secrets

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of `@beproduct/nestjs-auth` (0.1.2 through 0.1.19). The postinstall payload attempted to harvest npm tokens (from `~/.npmrc`); GitHub personal access tokens, OAuth tokens (`gho_*`), and Actions OIDC tokens; AWS credentials (from environment variables and `~/.aws/credentials`); HashiCorp Vault tokens; and other secrets present in environment variables. Version `0.1.20` is a clean republish from the original `0.1.1` source tree. Anyone who installed any version in the range `>=0.1.2 <=0.1.19` should remove the package and clean the npm cache; install the clean version; rotate every credential present in the install environment, including all npm publish tokens, all GitHub PATs and OAuth tokens, AWS access keys, HashiCorp Vault tokens, and any other secret that was in env vars or config files at install time; scan affected hosts for indicators of compromise and, if any are found, treat the host as compromised and reimage; and check committed repository history for unexpected additions in `.claude/` or `.vscode/` directories. The worm is known to commit `setup.mjs` + hook configs to PR branches via automated agent runtimes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-46412
EUVD
EUVD-2026-45992

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
beproduct nestjs-auth From 0.1.2 (inc) to 0.1.19 (inc)
beproduct nestjs-auth 0.1.20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-506 The product contains code that appears to be malicious in nature.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46412 is a critical supply-chain attack targeting the npm package @beproduct/nestjs-auth versions 0.1.2 through 0.1.19. An attacker used a compromised npm publish token to inject malicious code that executed automatically during package installation. The payload harvested sensitive credentials like npm tokens, GitHub tokens, AWS credentials, and HashiCorp Vault tokens, exfiltrating them to a remote server. The attack compromised the npm registry and spread via the Mini Shai-Hulud worm campaign.

Detection Guidance

Check for installed malicious versions of @beproduct/nestjs-auth (0.1.2 to 0.1.19) using npm list @beproduct/nestjs-auth. Look for suspicious files like tanstack_runner.js, router_init.js, or IDE hooks in .claude/ or .vscode/ directories. Monitor network traffic for connections to filev2.getsession.org.

Impact Analysis

If you installed versions 0.1.2 to 0.1.19, your credentials may have been stolen, including npm tokens, GitHub tokens, AWS keys, and Vault tokens. The malware created persistence files and IDE hooks, potentially compromising your development environment. Attackers could use stolen tokens to access repositories, cloud resources, or publish malicious packages. You should rotate all exposed credentials, uninstall the package, clean the npm cache, and scan for signs of compromise.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data via stolen credentials, and HIPAA if healthcare-related secrets were exposed. Organizations must report breaches under GDPR within 72 hours and under HIPAA without unreasonable delay. Failure to rotate credentials or detect breaches could result in regulatory penalties for non-compliance.

Mitigation Strategies

Uninstall affected versions with npm uninstall @beproduct/nestjs-auth. Clean the npm cache using npm cache clean --force. Install version 0.1.20. Rotate all credentials exposed during installation, including npm tokens, GitHub tokens, AWS keys, and Vault tokens. Scan for indicators of compromise and reimage compromised hosts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46412. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart