Skip to content
OpenAdvisories

Package · npm

@beproduct/nestjs-auth

1 known vulnerabilities.

Malicious versions reported for this package

  • MAL-2026-3433 — 0.1.18, 0.1.19, 0.1.17, 0.1.16, 0.1.15, 0.1.14, 0.1.13, 0.1.12, 0.1.11, 0.1.9, 0.1.8, 0.1.7, 0.1.6, 0.1.5, 0.1.4, 0.1.3… · May 12, 2026
All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 10.0
    CVE-2026-46412

    Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

    @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of `@beprod…

    BeProduct beproduct-org-nestjs-auth @beproduct/nestjs-auth npm