Malicious code in 2nestjs (npm)

The 2nestjs package, a numeric-prefix typosquat of nestjs, contains malicious code in its postinstall hook. This hook enumerates environment variables, filters those matching sensitive key patterns (SECRET, API, TOKEN, KEY), serializes their values, and sends them over a raw TCP socket to a hardcoded remote host (84.32.22.44:9999). Additionally, it invokes a netcat command to open an interactive reverse shell to the same host, granting the attacker full remote command execution on the victim's system. The package's own metadata and logs confirm its intent to target nestjs users via typosquatting.

Installation of version 0.0.1 of the 2nestjs package results in exfiltration of sensitive environment variables and establishes a remote shell, enabling an attacker to execute arbitrary commands on the affected system. This compromises confidentiality and integrity of the environment and system.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing 2nestjs and verify package names carefully to avoid typosquatting. Remove the package if installed and investigate any potential compromise. Use trusted sources and package integrity verification mechanisms.