@nimbusedge2/authxsas

GHSA-8mrv-jcm6-9rv3

Malicious code in @nimbusedge2/authxsas (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.0`

## Source: amazon-inspector (0146259024cc8ef3a174ff98571fe4af975b3eecf9184a0a5339d42808243d10)
The package's package.json declares a preinstall script that fires unconditionally on `npm install`. The script uses curl to query the cloud instance metadata service via the nip.io wildcard-DNS resolver (169.254.169.254.nip.io/latest/meta-data/), base64-encodes the response, and POSTs it over plain HTTP to a hardcoded canarytokens.com endpoint (http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php). On installers running on AWS/GCP/Azure hosts with IMDS reachable, this leaks IAM role identifiers and, on IMDSv1, temporary cloud credentials to a third-party canary endpoint at install time. The tarball ships no source files; the manifest and its preinstall hook are the entire payload. The scope name and package name are consistent with a dependency-confusion / SSRF canary probe targeting an internal namespace.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/@nimbusedge2/authxsas/MAL-2026-16303.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/@nimbusedge2/authxsas/MAL-2026-16303.json
- https://www.npmjs.com/package/@nimbusedge2/authxsas/v/1.1.0
- https://github.com/advisories/GHSA-8mrv-jcm6-9rv3

Compromised versions (1)

= 1.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.