Malicious code in @nimbusedge/auth (npm)
The npm package @nimbusedge/auth at multiple artificially inflated versions contains a malicious preinstall script that opens an interactive reverse shell to a hardcoded remote host and exfiltrates command output via HTTP. This occurs automatically during npm install, enabling remote code execution and data leakage on the installer's machine. The package uses dependency confusion tactics by mimicking private package names with high version numbers to trick internal resolvers into fetching the malicious public package.
AI Analysis
Technical Summary
The @nimbusedge/auth npm package versions including =19999.0.1 through =19999.1360.5 and =221.1.0 contain a preinstall lifecycle script that executes a bash command opening an interactive reverse shell to 147.93.157.202 on port 8080. The shell session output is sent via HTTP POST to a hardcoded URL at canarytokens.com. This script runs automatically on npm install, allowing the remote attacker interactive command execution on the victim's machine and exfiltration of session data. The package employs artificially inflated version numbers consistent with dependency confusion attacks, causing internal package resolvers to mistakenly fetch this malicious public package instead of a legitimate private one.
Potential Impact
Successful installation of the affected package results in remote code execution on the installer's system with an interactive reverse shell to a remote attacker. Additionally, the attacker receives exfiltrated session output data via HTTP. This compromises the confidentiality and integrity of the installer's environment and potentially any systems accessible from it.
Mitigation Recommendations
No official patch or remediation is documented in the provided data. Users should avoid installing the @nimbusedge/auth package from public npm registries, especially versions with artificially inflated version numbers. Verify package sources and implement strict package resolution policies to prevent dependency confusion. Monitor for and remove any installations of these malicious versions. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.
Malicious code in @nimbusedge/auth (npm)
Description
The npm package @nimbusedge/auth at multiple artificially inflated versions contains a malicious preinstall script that opens an interactive reverse shell to a hardcoded remote host and exfiltrates command output via HTTP. This occurs automatically during npm install, enabling remote code execution and data leakage on the installer's machine. The package uses dependency confusion tactics by mimicking private package names with high version numbers to trick internal resolvers into fetching the malicious public package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @nimbusedge/auth npm package versions including =19999.0.1 through =19999.1360.5 and =221.1.0 contain a preinstall lifecycle script that executes a bash command opening an interactive reverse shell to 147.93.157.202 on port 8080. The shell session output is sent via HTTP POST to a hardcoded URL at canarytokens.com. This script runs automatically on npm install, allowing the remote attacker interactive command execution on the victim's machine and exfiltration of session data. The package employs artificially inflated version numbers consistent with dependency confusion attacks, causing internal package resolvers to mistakenly fetch this malicious public package instead of a legitimate private one.
Potential Impact
Successful installation of the affected package results in remote code execution on the installer's system with an interactive reverse shell to a remote attacker. Additionally, the attacker receives exfiltrated session output data via HTTP. This compromises the confidentiality and integrity of the installer's environment and potentially any systems accessible from it.
Mitigation Recommendations
No official patch or remediation is documented in the provided data. Users should avoid installing the @nimbusedge/auth package from public npm registries, especially versions with artificially inflated version numbers. Verify package sources and implement strict package resolution policies to prevent dependency confusion. Monitor for and remove any installations of these malicious versions. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16132
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6aa47ec055bf5e2cf58579f6
Added to database: 09/11/2026, 22:20:48 UTC
Last enriched: 09/11/2026, 22:34:16 UTC
Last updated: 09/11/2026, 23:10:12 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.