A supply chain compromise of the beproduct-org-nestjs-auth module has resulted in the distribution of malicious code capable of harvesting sensitive credentials and environment variables.

This is an embedded malicious code vulnerability (CWE-506) where unauthorized actors injected a payload into the package that exfiltrates npm tokens, GitHub PATs, AWS credentials, and HashiCorp Vault secrets. The attack requires no authentication as it executes automatically upon installation.

The impact of this vulnerability is critical, as it facilitates a complete compromise of the development and deployment environments. Successful exploitation allows attackers to steal long-lived credentials, potentially leading to unauthorized access to cloud infrastructure, source code repositories, and production systems. Given the CVSS score of 10.0, this represents a total loss of confidentiality, integrity, and availability for the affected host.

Immediate Action: Remove the compromised package, clear the npm cache, and install version 0.1.20 or later. Crucially, rotate all credentials that were present in the environment at the time of installation, including AWS keys, GitHub tokens, and npm publish tokens.

Proactive Monitoring: Audit CI/CD pipelines and developer workstations for indicators of compromise, specifically checking for unexpected files in .claude/ or .vscode/ directories.

Compensating Controls: Implement supply chain security tools that perform dependency scanning and verify package integrity before installation.

Public Exploit Available: No (Exploit available: false)

Users of the affected package must treat all systems where these versions were installed as potentially compromised. Immediate rotation of every secret present in the environment is mandatory, followed by a thorough forensic audit of the affected hosts to ensure no persistence mechanisms were established by the malicious payload.