CVE-2026-46412

The record

Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of `@beproduct/nestjs-auth` (0.1.2 through 0.1.19). The packages contained payloads from the **Mini Shai-Hulud** npm supply-chain worm campaign described by [Aikido Security](https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised). npm Security removed the malicious versions from the registry shortly after publication, but anyone who ran `npm install @beproduct/nestjs-auth` resolving to any version in the affected range during that window executed the malicious postinstall script and is potentially compromised. Version `0.1.20` is a clean republish from the original `0.1.1` source tree.

Affected packages

Related vulnerabilities

• GHSA-6xwp-cp5h-q856 Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm Same vulnerability
• CVE-2026-73532 Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a… CWE-506
• CVE-2026-73533 Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via… CWE-506
• CVE-2026-48160 react-tracked provides state usage tracking with Proxies. CWE-506
• CVE-2026-48159 use-reducer-async is a React useReducer with async actions. CWE-506
• CVE-2026-48158 use-context-selector is a React useContextSelector hook in userland Between 2026-05-18… CWE-506
• CVE-2026-66747 Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present… CWE-506
• CVE-2026-45758 Guardrails AI is a Python framework that helps build AI applications. CWE-506