@nimbusedge2/authxsas1

GHSA-92qm-hjm8-mp6j

Malicious code in @nimbusedge2/authxsas1 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.0`

## Source: amazon-inspector (0b27280b8f4c1e044e49b77e58c7c8de895a002f51be51756bc40e909d3f6fa1)
package.json declares a preinstall lifecycle script that runs automatically on `npm install`. The script uses curl to fetch the cloud instance metadata service (169.254.169.254, accessed via the nip.io wildcard-DNS wrapper `169.254.169.254.nip.io/latest/meta-data/`), base64-encodes the response, and POSTs it to a hardcoded third-party endpoint at http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php. On cloud and CI installers this discloses instance identity metadata and, where IMDSv1 is reachable, temporary IAM credentials to the destination. The package's description field self-labels the beacon as an 'Authorized report' with a wearehackerone.com contact address; that label is author-controlled and does not change the behavior class — installing the package causes installer-side host and cloud metadata to be sent off-host to a canarytoken beacon.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/@nimbusedge2/authxsas1/MAL-2026-16304.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/@nimbusedge2/authxsas1/MAL-2026-16304.json
- https://www.npmjs.com/package/@nimbusedge2/authxsas1/v/1.1.0
- https://github.com/advisories/GHSA-92qm-hjm8-mp6j

Compromised versions (1)

= 1.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.