@beproduct/nestjs-auth, a NestJS authentication module for BeProduct IDS, was compromised via a stolen npm publish token, leading to the publication of 18 malicious versions (0.1.2 through 0.1.19). The malicious postinstall script attempted to exfiltrate sensitive credentials from environment variables and configuration files, including npm tokens, GitHub tokens, AWS credentials, and Vault tokens. The clean version 0.1.20 restores the original source code. The attack includes persistence mechanisms that commit malicious files to PR branches. This vulnerability is classified under CWE-506 (Embedded Malicious Code) and carries a CVSS 3.1 score of 10.0 (critical). The product is a cloud service, and remediation involves removing affected versions, credential rotation, and host compromise assessment.

The malicious versions of the package can lead to the theft of a wide range of sensitive credentials and tokens from the installation environment, including npm publish tokens, GitHub personal access tokens, OAuth tokens, AWS credentials, and HashiCorp Vault tokens. This can result in full compromise of developer environments, source code repositories, cloud resources, and secret management systems. The embedded malicious code also attempts to maintain persistence by committing malicious files to pull request branches, increasing the risk of further compromise and lateral movement.

A patch is available in the form of version 0.1.20, which is a clean republish from the original source. Users who installed any version between 0.1.2 and 0.1.19 inclusive should immediately remove those versions, clean the npm cache, and install version 0.1.20. All credentials present during installation—including npm publish tokens, GitHub personal access tokens, OAuth tokens, AWS access keys, and HashiCorp Vault tokens—must be rotated. Hosts should be scanned for indicators of compromise, and any compromised hosts should be reimaged. Additionally, repository history should be checked for unauthorized commits in .claude/ or .vscode/ directories. Since this is a cloud service, the vendor manages remediation for the service itself, but local environment remediation is critical.