External risk intelligence

`@beproduct/nestjs-auth` Malicious Package Steals npm GitHub AWS and Vault Secrets.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-46412

The vulnerability exists within a software development package (npm) that executes malicious code only at install-time on a developer's machine or in a build/CI/CD environment. It does not expose a network-facing service, API, or web application to the public internet in common production deployment patterns.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A compromised software package was published that could have exposed sensitive credentials like API keys and tokens if installed. Version 0.1.20 is a clean republish. The main concern is confirming relevance and exposure.

Malicious code harvested secrets during package installation.
Confirms exposure and relevance to your development environment.
Review development tools and rotate all credentials.

Attack Path

How an attacker could exploit the issue

An attacker could compromise the integrity of the `@beproduct/nestjs-auth` package by publishing malicious versions. Developers who then install these compromised versions inadvertently execute a post-install script designed to harvest sensitive credentials and tokens from their development environment.

Entry Condition: Developer installs a malicious package version.
Trigger Point: Package installation process runs `postinstall` script.
Resulting Risk: Sensitive developer credentials may be exposed.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect secrets used during the software development and build process, specifically when installing a malicious version of the `@beproduct/nestjs-auth` package. When installed, the package attempts to harvest various tokens and credentials, such as npm publish tokens, GitHub tokens, AWS credentials, and HashiCorp Vault tokens, if they are present in the environment.

Secrets in the installation environment.
Malicious package installation on developer machines.
Exposure of sensitive credentials and tokens.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ownership for this incident likely falls to the Platform or DevOps teams responsible for the build and CI/CD pipelines where the malicious package was installed. The first practical step is to identify all environments where `@beproduct/nestjs-auth` versions `0.1.2` through `0.1.19` may have been installed, confirm the scope of potential credential exfiltration, and then coordinate a comprehensive remediation plan.

Platform/DevOps teams own the issue.
Verify all npm publish, GitHub, and AWS credentials.
Rotate all exposed secrets and scan for compromises.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is @beproduct/nestjs-auth?

It is a specialized authentication module designed for NestJS applications. Developers use it to integrate BeProduct’s Identity Server, allowing their applications to handle user identity and OpenID Connect protocols securely within the BeProduct ecosystem.

What does CWE-506 mean for CVE-2026-46412?

CWE-506 identifies this as an Embedded Malicious Code weakness. In this specific case, it means the software package contained hidden instructions designed to perform unauthorized actions—specifically, stealing sensitive security tokens and credentials—without the user's knowledge or consent during installation.

How is this malicious code triggered?

The malicious payload executes automatically when the package is installed, as it is tied to the software's post-install process. Simply having the package in your repository is not enough; the code runs only when the installation command completes. If you never installed versions 0.1.2 through 0.1.19, the malicious script did not run.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that this is a development-time threat rather than a standard web-facing vulnerability. Since the malicious code executes during installation on a developer's machine or in a build pipeline, the risk is centered on your internal development infrastructure rather than an exposed public web service.

What should I do if I installed an affected version?

Remove the package immediately, clear your npm cache, and install version 0.1.20. Because the malicious script actively harvested secrets, you must assume any credentials present on that machine—such as AWS keys, GitHub tokens, or Vault secrets—are compromised. Rotate all these credentials globally and audit your repository history for unauthorized changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.