CVE-2026-46412 Details

A supply chain vulnerability has been identified in the @beproduct/nestjs-auth package, specifically in versions 0.1.2 through 0.1.19. During a brief window on May 11, 2026, an attacker exploited a compromised npm publish token to release 18 malicious versions of the package. These versions included a postinstall payload designed to steal various credentials and secrets from the user's environment, such as npm tokens, GitHub personal access tokens, AWS credentials, and HashiCorp Vault tokens. The stolen information was exfiltrated to an external server, and the malicious code also established persistence by writing files into the developer's working directory. The vulnerability has been linked to the 'Mini Shai-Hulud' npm worm campaign, which targeted other packages in addition to @beproduct/nestjs-auth.

Users should uninstall the @beproduct/nestjs-auth package, clean the npm cache, and then reinstall the package, ensuring to get the clean version 0.1.20. After reinstalling, it is crucial to rotate all credentials that were present in the environment during the installation of the malicious version, including npm tokens, GitHub personal access tokens, AWS credentials, HashiCorp Vault tokens, and any other secrets that were in environment variables or configuration files at that time. Additionally, users should scan their systems for the indicators of compromise associated with this vulnerability, and if any are found, treat the host as compromised and reimage it.