CVE-2026-46412 BeProduct CVE debrief

Who should care

Developers and administrators who used @beproduct/nestjs-auth versions between 0.1.2 and 0.1.19 should take immediate action to secure their environments. This includes removing the compromised package, cleaning the npm cache, and installing the clean version. Additionally, rotating credentials and scanning for indicators of compromise are crucial steps.

Technical summary

The @beproduct/nestjs-auth package, used for NestJS authentication with BeProduct IDS and OpenID Connect support, was compromised. An attacker published 18 malicious versions (0.1.2 through 0.1.19) using a compromised npm publish token. The postinstall payload in these versions attempted to harvest various sensitive information, including npm tokens, GitHub personal access tokens, AWS credentials, and HashiCorp Vault tokens. The clean version 0.1.20 was republished from the original 0.1.1 source tree.

Defensive priority

High

Recommended defensive actions

• Remove the compromised package and clean the npm cache
• Install the clean version 0.1.20
• Rotate all npm publish tokens, GitHub PATs and OAuth tokens, AWS access keys, HashiCorp Vault tokens, and other secrets present in the install environment
• Scan affected hosts for indicators of compromise
• Check committed repository history for unexpected additions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The malicious package was published between 2026-05-11 20:19 UTC and 22:56 UTC. The clean version 0.1.20 was republished from the original 0.1.1 source tree. Limited source detail is available for further verification of affected scope and impact. Defenders should verify package installation and environment integrity with available evidence.

Official resources