CVE-2026-46412
A malicious version of the @beproduct/nestjs-auth package was published to npm between 20:19 and 22:56 UTC on 2026-05-11. The post‑install script harvested a wide range of credentials from the environment, including npm tokens, GitHub PATs, AWS keys, and Vault tokens. The clean version 0.1.20 was republished from the original source.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Developers who installed @beproduct/nestjs-auth versions 0.1.2 through 0.1.19 for use with NestJS and BeProduct IDS.
Real-world impact
An attacker who gains access to a system that installed one of the compromised package versions can harvest all secrets present in that environment—npm publish tokens, GitHub personal access tokens, OAuth tokens, AWS access keys, HashiCorp Vault tokens, and any other credentials stored in environment variables or config files—potentially allowing full compromise of the developer’s accounts and infrastructure.
Why this severity
The CVSS score of 10 reflects that the vulnerability allows an attacker to fully compromise confidentiality, integrity, and availability of all secrets on the system without any authentication or user interaction, and the impact is complete.
What to do about it
- 01Uninstall any @beproduct/nestjs-auth version 0.1.2–0.1.19.
- 02Clear the npm cache with `npm cache clean --force`.
- 03Install the clean version 0.1.20 using `npm install @beproduct/nestjs-auth@0.1.20`.
- 04Rotate all credentials that may have been exposed (npm tokens, GitHub PATs/OAuth, AWS keys, Vault tokens, etc.).
- 05Scan affected hosts for signs of compromise; if found, treat the host as compromised and reimage.
- 06Review repository history for unexpected additions in .claude/ or .vscode/ directories.
NVD-referenced vendor advisory
Timeline
- Jul 20, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.