{"items":[{"id":"NVI-00010037","kind":"supply_chain_event","title":"Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3gr7-5653-7jxx"],"plain_summary":"GitHub lists this malware advisory for @galicia-toolkit-nestjs-20-lite/archetype, @galicia-toolkit-nestjs-20-lite/archetype, @galicia-toolkit-nestjs-20-lite/archetype, @galicia-toolkit-nestjs-20-lite/archetype, @galicia-toolkit-nestjs-20-lite/archetype. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-c4837b48151833e790832a885384b642"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-c4837b48151833e790832a885384b642","url":"https://github.com/advisories/GHSA-3gr7-5653-7jxx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3gr7-5653-7jxx","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:53.250Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-c4837b48151833e790832a885384b642"],"technology":"@galicia-toolkit-nestjs-20-lite/archetype","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (524c80bfea6a1b22cb0a4784d2763ccf83099faab3816c9fcb1ce39bb8813152)\nOn `npm install`, this package runs `node index.js || true` as a `preinstall` script. `index.js` loads a platform-specific native addon from `prebuilds/-/metrics.node`. The Linux and Windows binaries contain the hardcoded host `oob.s4yhii.com` and a `POST /native HTTP/1.0` request line with a JSON template carrying `src`, `pkg`, `h` (hostname), `u` (username), `os`, `arch`, `rel`, `cwd`, and `e` (an environment-variable dictionary). The native code reads a hardcoded set of credential-bearing environment variables including AWS access keys, `GITHUB_TOKEN`, `NPM_TOKEN`, `NODE_AUTH_TOKEN`, Azure DevOps PAT, and GitHub Actions runtime/ID tokens, and ships them to that host over a raw socket (getaddrinfo/connect/send; WS2_32 on Windows). The Linux variant uses fork+setsid to detach the exfiltration process from the install. The shipped JavaScript is a stub exporting empty `forRoot`/`createLogger`, with no real functionality beyond loading the addon. The package name uses a scoped namespace that resembles an internal toolkit and is published at version 999.0.3, a version-oversho","public_affected_ranges":["= 999.0.5"]},{"certainty":"source_listed","source_ids":["sr-c4837b48151833e790832a885384b642"],"technology":"@galicia-toolkit-nestjs-20-lite/archetype","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (524c80bfea6a1b22cb0a4784d2763ccf83099faab3816c9fcb1ce39bb8813152)\nOn `npm install`, this package runs `node index.js || true` as a `preinstall` script. `index.js` loads a platform-specific native addon from `prebuilds/-/metrics.node`. The Linux and Windows binaries contain the hardcoded host `oob.s4yhii.com` and a `POST /native HTTP/1.0` request line with a JSON template carrying `src`, `pkg`, `h` (hostname), `u` (username), `os`, `arch`, `rel`, `cwd`, and `e` (an environment-variable dictionary). The native code reads a hardcoded set of credential-bearing environment variables including AWS access keys, `GITHUB_TOKEN`, `NPM_TOKEN`, `NODE_AUTH_TOKEN`, Azure DevOps PAT, and GitHub Actions runtime/ID tokens, and ships them to that host over a raw socket (getaddrinfo/connect/send; WS2_32 on Windows). The Linux variant uses fork+setsid to detach the exfiltration process from the install. The shipped JavaScript is a stub exporting empty `forRoot`/`createLogger`, with no real functionality beyond loading the addon. The package name uses a scoped namespace that resembles an internal toolkit and is published at version 999.0.3, a version-oversho","public_affected_ranges":["= 999.0.2"]},{"certainty":"source_listed","source_ids":["sr-c4837b48151833e790832a885384b642"],"technology":"@galicia-toolkit-nestjs-20-lite/archetype","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (524c80bfea6a1b22cb0a4784d2763ccf83099faab3816c9fcb1ce39bb8813152)\nOn `npm install`, this package runs `node index.js || true` as a `preinstall` script. `index.js` loads a platform-specific native addon from `prebuilds/-/metrics.node`. The Linux and Windows binaries contain the hardcoded host `oob.s4yhii.com` and a `POST /native HTTP/1.0` request line with a JSON template carrying `src`, `pkg`, `h` (hostname), `u` (username), `os`, `arch`, `rel`, `cwd`, and `e` (an environment-variable dictionary). The native code reads a hardcoded set of credential-bearing environment variables including AWS access keys, `GITHUB_TOKEN`, `NPM_TOKEN`, `NODE_AUTH_TOKEN`, Azure DevOps PAT, and GitHub Actions runtime/ID tokens, and ships them to that host over a raw socket (getaddrinfo/connect/send; WS2_32 on Windows). The Linux variant uses fork+setsid to detach the exfiltration process from the install. The shipped JavaScript is a stub exporting empty `forRoot`/`createLogger`, with no real functionality beyond loading the addon. The package name uses a scoped namespace that resembles an internal toolkit and is published at version 999.0.3, a version-oversho","public_affected_ranges":["= 999.0.1"]},{"certainty":"source_listed","source_ids":["sr-c4837b48151833e790832a885384b642"],"technology":"@galicia-toolkit-nestjs-20-lite/archetype","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (524c80bfea6a1b22cb0a4784d2763ccf83099faab3816c9fcb1ce39bb8813152)\nOn `npm install`, this package runs `node index.js || true` as a `preinstall` script. `index.js` loads a platform-specific native addon from `prebuilds/-/metrics.node`. The Linux and Windows binaries contain the hardcoded host `oob.s4yhii.com` and a `POST /native HTTP/1.0` request line with a JSON template carrying `src`, `pkg`, `h` (hostname), `u` (username), `os`, `arch`, `rel`, `cwd`, and `e` (an environment-variable dictionary). The native code reads a hardcoded set of credential-bearing environment variables including AWS access keys, `GITHUB_TOKEN`, `NPM_TOKEN`, `NODE_AUTH_TOKEN`, Azure DevOps PAT, and GitHub Actions runtime/ID tokens, and ships them to that host over a raw socket (getaddrinfo/connect/send; WS2_32 on Windows). The Linux variant uses fork+setsid to detach the exfiltration process from the install. The shipped JavaScript is a stub exporting empty `forRoot`/`createLogger`, with no real functionality beyond loading the addon. The package name uses a scoped namespace that resembles an internal toolkit and is published at version 999.0.3, a version-oversho","public_affected_ranges":["= 999.0.3"]},{"certainty":"source_listed","source_ids":["sr-c4837b48151833e790832a885384b642"],"technology":"@galicia-toolkit-nestjs-20-lite/archetype","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (524c80bfea6a1b22cb0a4784d2763ccf83099faab3816c9fcb1ce39bb8813152)\nOn `npm install`, this package runs `node index.js || true` as a `preinstall` script. `index.js` loads a platform-specific native addon from `prebuilds/-/metrics.node`. The Linux and Windows binaries contain the hardcoded host `oob.s4yhii.com` and a `POST /native HTTP/1.0` request line with a JSON template carrying `src`, `pkg`, `h` (hostname), `u` (username), `os`, `arch`, `rel`, `cwd`, and `e` (an environment-variable dictionary). The native code reads a hardcoded set of credential-bearing environment variables including AWS access keys, `GITHUB_TOKEN`, `NPM_TOKEN`, `NODE_AUTH_TOKEN`, Azure DevOps PAT, and GitHub Actions runtime/ID tokens, and ships them to that host over a raw socket (getaddrinfo/connect/send; WS2_32 on Windows). The Linux variant uses fork+setsid to detach the exfiltration process from the install. The shipped JavaScript is a stub exporting empty `forRoot`/`createLogger`, with no real functionality beyond loading the addon. The package name uses a scoped namespace that resembles an internal toolkit and is published at version 999.0.3, a version-oversho","public_affected_ranges":["> 0"]}],"null_published_at":"2026-10-31T22:13:44.207Z","source_updated_at":"2026-10-12T06:31:27.000Z","source_disclosed_at":"2026-10-09T15:31:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:06:53.250Z"}],"next_cursor":null,"snapshot_revision":"42594"}