Threats Tagged 'mal-2026-16132'

The npm package @nimbusedge/auth at multiple artificially inflated versions contains a malicious preinstall script that opens an interactive reverse shell to a hardcoded remote host and exfiltrates command output via HTTP. This occurs automatically during npm install, enabling remote code execution and data leakage on the installer's machine. The package uses dependency confusion tactics by mimicking private package names with high version numbers to trick internal resolvers into fetching the malicious public package.