CVE-2026-46412: NestJS Auth Module Supply Chain Attack

CVE-2026-46412 Overview

CVE-2026-46412 is a supply chain compromise affecting the @beproduct/nestjs-auth npm package, a NestJS authentication module for BeProduct Identity Server (IDS) with OpenID Connect support. An attacker used a stolen npm publish token to release 18 malicious versions (0.1.2 through 0.1.19) within a two-hour window. The malicious postinstall payload harvests npm tokens, GitHub personal access tokens, OAuth tokens, GitHub Actions OIDC tokens, AWS credentials, HashiCorp Vault tokens, and other secrets from the install environment. The weakness is categorized under [CWE-506] Embedded Malicious Code.

Critical Impact
Any environment that installed a compromised version had its npm, GitHub, AWS, and Vault credentials exfiltrated, enabling downstream account takeover and secondary supply chain compromise.

Affected Products

@beproduct/nestjs-auth versions 0.1.2 through 0.1.19
NestJS applications integrating BeProduct IDS via this module
Any CI/CD pipeline or developer workstation that installed a tainted version

Discovery Timeline

2026-05-11 - Malicious versions 0.1.2 through 0.1.19 published via compromised npm token between 20:19 UTC and 22:56 UTC
2026-07-20 - CVE-2026-46412 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-46412

Vulnerability Analysis

The issue is not a code defect in the legitimate module but a package registry compromise. An attacker with stolen publish credentials pushed 18 successive tainted releases of @beproduct/nestjs-auth to npm. Each release carried a postinstall hook that executed automatically when a developer or CI runner ran npm install. The payload targets credential material commonly available to build environments and forwards it to attacker-controlled infrastructure. Version 0.1.20 is a clean republish based on the original 0.1.1 source tree.

Root Cause

The root cause is a compromised npm publish token belonging to a maintainer account. npm registry trust relies on package maintainer credentials, and no signature verification or provenance check blocked the malicious uploads. Consumers received the payload transparently through normal dependency resolution and lockfile updates.

Attack Vector

The attack chain begins at npm install, which invokes the postinstall lifecycle script bundled with the malicious tarball. The script reads ~/.npmrc to steal npm tokens, scans environment variables for gho_* GitHub OAuth tokens, personal access tokens, and Actions OIDC tokens, extracts AWS keys from ~/.aws/credentials and process environment, and collects HashiCorp Vault tokens. The worm component commits setup.mjs and hook configurations into .claude/ and .vscode/ directories on pull request branches through automated agent runtimes, enabling propagation across repositories.

No verified exploit code samples are published. See the GitHub Security Advisory for the full technical breakdown.

Detection Methods for CVE-2026-46412

Indicators of Compromise

Presence of @beproduct/nestjs-auth at any version between 0.1.2 and 0.1.19 in package.json or package-lock.json
Unexpected setup.mjs files or hook configurations committed to .claude/ or .vscode/ directories in repository history
Outbound network connections from build agents to unknown hosts during npm install
Unexplained use of npm publish tokens, GitHub PATs, or AWS keys following a build event on or after 2026-05-11

Detection Strategies

Audit dependency manifests and lockfiles across all repositories for the affected version range using automated software composition analysis
Review git log for automated commits touching .claude/, .vscode/, or root-level setup.mjs on feature or PR branches
Correlate CI/CD job logs with npm registry download telemetry to identify hosts that pulled the tainted versions

Monitoring Recommendations

Alert on child processes spawned by npm, pnpm, or yarn that read ~/.npmrc, ~/.aws/credentials, or environment token variables
Monitor for anomalous use of GitHub Actions OIDC tokens and unexpected npm package publications from maintainer accounts
Track AWS CloudTrail and GitHub audit logs for credential usage originating from IP ranges outside normal CI infrastructure

How to Mitigate CVE-2026-46412

Immediate Actions Required

Remove any installed version of @beproduct/nestjs-auth in the range >=0.1.2 <=0.1.19 and run npm cache clean --force
Install version 0.1.20 or later, which is a clean republish of the 0.1.1 source tree
Rotate every credential exposed to the install environment: npm publish tokens, GitHub PATs and OAuth tokens, AWS access keys, HashiCorp Vault tokens, and any secret stored in environment variables or config files
Reimage any host where indicators of compromise are confirmed rather than attempting in-place cleanup

Patch Information

Upgrade to @beproduct/nestjs-auth version 0.1.20. This release is a clean republish from the pre-compromise 0.1.1 source. Pin the version explicitly in package.json and regenerate package-lock.json after removing cached tarballs. Refer to the GitHub Security Advisory GHSA-6xwp-cp5h-q856 for the vendor guidance.

Workarounds

Disable npm lifecycle scripts during installation with npm install --ignore-scripts in CI until dependency review completes
Use short-lived, scoped npm tokens with 2FA-enforced publish protection to limit blast radius of future maintainer compromise
Enforce OIDC-based cloud authentication in CI/CD to eliminate long-lived AWS access keys from build environments
Review committed repository history for unexpected additions in .claude/ or .vscode/ directories and revert any unauthorized changes

bash

# Remove the malicious package and reinstall the clean version
npm uninstall @beproduct/nestjs-auth
npm cache clean --force
npm install @beproduct/nestjs-auth@0.1.20

# Harden future installs against postinstall payloads
npm config set ignore-scripts true