Malicious code in 0nestjs (npm)

The '0nestjs' package (version 0.0.1) is a malicious npm package designed to exploit developers who accidentally install it instead of the legitimate 'nestjs' package. Its postinstall hook runs 'node index.js', which collects environment variables matching /^(SECRET|API|TOKEN|KEY)/ and sends them as JSON to a hardcoded IP address (84.32.22.44) on port 9999. Additionally, it uses 'nc -e /bin/sh' to open a reverse shell to the same endpoint, granting the attacker remote command execution capabilities. The package.json explicitly identifies the package as a typosquat with author 'typosquat-bot'. This behavior was identified by Amazon Inspector and the OpenSSF Package Analysis project, confirming its malicious nature.

Successful installation of this package results in disclosure of sensitive environment variables (such as secrets, API keys, tokens) to a remote attacker. Furthermore, the attacker gains interactive shell access on the victim's machine, enabling arbitrary command execution. This can lead to full system compromise, data theft, and further malicious activity.

Avoid installing packages with suspicious or typo-like names. Verify package names carefully before installation. Remove the '0nestjs' package if installed. Since no official patch or fix exists for this malicious package, remediation involves uninstalling the package and rotating any potentially exposed secrets. Use trusted package sources and consider enabling package integrity verification tools. Monitor for any unauthorized access resulting from this compromise.