registry / Install hook abuse / 1nestjs
1nestjs
Typosquat of nestjs
This report shows the evidence for 1nestjs@0.0.1, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an automatic install-time credential-harvesting and reverse-shell payload, reinforced by explicit typosquat metadata. It warrants blocking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package runs its postinstall script.
Impact
Secrets in matching environment variables may be disclosed and the installer host may expose a remote shell.
Mechanism
Postinstall environment harvesting, socket exfiltration, and netcat shell execution.
Attack narrative
When npm installs the package, postinstall executes index.js. The script reads its server list, gathers environment variables with names beginning SECRET, API, TOKEN, or KEY, and sends them to 84.32.22.44 on port 9999. It then invokes netcat with /bin/sh attached to that host and port, enabling a reverse shell attempt.
AI rationale
This is an automatic install-time credential-harvesting and reverse-shell payload, reinforced by explicit typosquat metadata. It warrants blocking.
Evidence
package.jsonindex.jsservers.json./servers.jsonprocess.env/bin/sh
Network endpoints1
84.32.22.44:9999
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package identifies itself as a typosquat of nestjs.
- Its postinstall hook automatically runs index.js during installation.
- index.js collects environment variables whose names suggest secrets, API credentials, tokens, or keys and sends them to a configured server.
- The install hook also starts netcat with a shell attached to the configured host and port.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg2"name": "1nestjs",
"version": "0.0.1",
"description": "Typosquat of nestjs",
"main": "index.js",
"scripts": {
"postinstall": "node index.js",
High
Typosquat Dependency
The package identifies itself as a typosquat of nestjs.
package.jsonView on unpkg · L26"scripts": {
"postinstall": "node index.js",
"start": "node index.js"
}
High
Suspicious Lifecycle Evidence
Its postinstall hook automatically runs index.js during installation.
package.jsonView on unpkg · L6index.jsView file
Findings
2 Critical6 High2 Medium2 Low
CriticalReverse Shellindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processindex.js
HighSame File Env Network Executionindex.js
HighTyposquat Dependencypackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to 1nestjs@0.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing 1nestjs@0.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.