NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

Malicious code in @galicia-toolkit-nestjs/archetype (npm)

Source: amazon-inspector 63cdc34da85584342e27bc84d22c01a826c71020b7bf07987626cbe457e2e560 The package ships a minimal index.js stub that loads a prebuilt native ELF addon at prebuilds/linux-x64/metrics.node on require. The addon reads CI/CD and cloud credentials from the environment AWSACCESSKEYI...

Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)

Source: amazon-inspector fb9736fcd5112c468c10509da5d624384a70802de5e20b218ad2cbebe0c7a443 The package declares scripts.preinstall node index.js || true, and index.js also the main entry requires a platform-specific prebuilt native addon at prebuilds/-/metrics.node. The native binary reads a curat...

Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

Source: amazon-inspector ffdc9c111498bf0f75d014ef58b811df488c9014addfb1ed64f7ab28cf9c11b1 On require'@galicia-toolkit-nestjs-20/paas', index.js unconditionally loads prebuilds/-/metrics.node at module top level inside a try/catch. The shipped ELF addon reads AWSACCESSKEYID, AWSSECRETACCESSKEY,...

Malicious code in @galicia-toolkit-nestjs-20/archetype (npm)

Source: amazon-inspector 662603823964bdbc871f386498e949d768c84d99645690ee3b5e904b458536db On module load, index.js unconditionally requires a bundled native binary at prebuilds/-/metrics.node inside a try/catch that swallows errors. The ELF reads installer-side credential-grade environment...

Malicious code in @galicia-toolkit-nestjs/paas (npm)

Source: amazon-inspector 5df4f7b59cbe90e6b36ce17f0870cd419345167d9aee683d65a43c65ea5fb213 The package's main entry index.js loads a prebuilt native addon prebuilds/-/metrics.node inside a try/catch on require. The ELF reads CI and cloud credentials from the environment — AWSACCESSKEYID,...

Malicious code in @galicia-toolkit-nestjs-20/commons (npm)

Source: amazon-inspector 5b719740efc4b3e93e85668e2e787b39a8d91e15abbe9c39f5d156e118745caa On require, index.js loads a bundled ELF native addon at prebuilds/linux-x64/metrics.node inside a silent try/catch. The addon reads CI/cloud credential environment variables AWSSECRETACCESSKEY and related...

Malicious code in @galicia-toolkit-nestjs/swagger (npm)

Source: amazon-inspector 605d8d8afe172d78840f3617c35733b47635a3482beba461bc1015c45840e250 The package presents itself as a NestJS Swagger integration name resembles @nestjs/swagger, published at version 999.0.2 in a dependency-confusion shape but ships a stub JavaScript API forRoot/createLogger...

Malicious code in @galicia-toolkit-nestjs/commons (npm)

Source: amazon-inspector eae27acb3901d275439e482d51a1451df67c1a6b2011f35881253a3fa8d2456b The package ships a tiny index.js that requires a bundled ELF at prebuilds/linux-x64/metrics.node inside a swallow-all try/catch on module load. No C/C++ source, binding.gyp, or node-gyp/prebuild tooling is...

Malicious code in @galicia-toolkit-nestjs-20-lite/commons (npm)

Source: amazon-inspector 9974df3d2695630f5921c98037f0359ed3948cc0afd0c13d4ad5043819950f15 package.json declares a preinstall hook node index.js || true, which require's a bundled native addon at prebuilds/-/metrics.node. On N-API registration the addon reads AWSACCESSKEYID, AWSSECRETACCESSKEY,...

Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

Source: amazon-inspector 524c80bfea6a1b22cb0a4784d2763ccf83099faab3816c9fcb1ce39bb8813152 On npm install, this package runs node index.js || true as a preinstall script. index.js loads a platform-specific native addon from prebuilds/-/metrics.node. The Linux and Windows binaries contain the...

MAL-2026-17730 Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb9736fcd5112c468c10509da5d624384a70802de5e20b218ad2cbebe0c7a443 The package declares scripts.preinstall node index.js || true, and index.js also the main entry requires a platform-specific prebuilt native addon at...

Malicious code in @galicia-toolkit-nestjs/commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eae27acb3901d275439e482d51a1451df67c1a6b2011f35881253a3fa8d2456b The package ships a tiny index.js that requires a bundled ELF at prebuilds/linux-x64/metrics.node inside a swallow-all try/catch on module load. No...

MAL-2026-17722 Malicious code in @galicia-toolkit-nestjs/commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eae27acb3901d275439e482d51a1451df67c1a6b2011f35881253a3fa8d2456b The package ships a tiny index.js that requires a bundled ELF at prebuilds/linux-x64/metrics.node inside a swallow-all try/catch on module load. No...

MAL-2026-17726 Malicious code in @galicia-toolkit-nestjs-20/commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b719740efc4b3e93e85668e2e787b39a8d91e15abbe9c39f5d156e118745caa On require, index.js loads a bundled ELF native addon at prebuilds/linux-x64/metrics.node inside a silent try/catch. The addon reads CI/cloud...

CLSA-2026-1790882031 TuxCare security update for @nestjs (1 CVE)

TuxCare rebuilt 8 @nestjs packages to address 1 CVE. Fixed in 11.2.4-tuxcare.1...

CLSA-2026-1790881234 TuxCare security update for @nestjs (2 CVEs)

TuxCare rebuilt 9 @nestjs packages to address 2 CVEs. Fixed in 11.2.3-tuxcare.1...

CLSA-2026-1790872587 TuxCare security update for @nestjs (2 CVEs)

TuxCare rebuilt 9 @nestjs packages to address 2 CVEs. Fixed in 11.2.2-tuxcare.1...

CLSA-2026-1790870019 TuxCare security update for @nestjs (1 CVE)

TuxCare rebuilt 9 @nestjs packages to address 1 CVE. Fixed in 10.4.22-tuxcare.3...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0), @zerly/microservice (>=0.7.0, <=0.8.0) potentially affected by unknown CVE via @nestjs/microservices (>=12.0.0-alpha.2, <=12.0.1)

@nestjs/microservices NPM version =12.0.0-alpha.2, =12.0.0, =0.7.0, =0.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-96H4-VGXJ-GVM2...