Malicious code in 1nestjs (npm)

The '1nestjs' package (version 0.0.1) is a typosquatting package targeting users who may mistakenly install it instead of the legitimate 'nestjs' package. During the npm install process, it runs a postinstall script that iterates over environment variables, extracting those with keys matching /^(SECRET|API|TOKEN|KEY)/, and sends this data as JSON over a raw TCP connection to a remote IP address (84.32.22.44) on port 9999. Additionally, it executes a netcat command to open an interactive shell on the attacker's host, allowing remote command execution on the victim's machine. The package metadata self-identifies as a typosquat, indicating intentional malicious behavior.

This package can lead to the compromise of sensitive environment variables such as secrets, API keys, tokens, and keys by exfiltrating them to an attacker-controlled server. Furthermore, it grants the attacker an interactive shell on the victim's machine, enabling full remote control and potential further compromise of the system where the package is installed.

No official patch or fix is available since this is a malicious typosquatting package. The primary mitigation is to avoid installing the '1nestjs' package and verify package names carefully before installation. Use trusted sources and official package names to prevent accidental installation of typosquatting packages. Consider using package integrity verification tools and npm security features to detect and block malicious packages.