Malicious Code Vulnerability in @galicia-toolkit-nestjs-20/archetype Package
Summary
MAL-2026-17725: Malicious code in @galicia-toolkit-nestjs-20/archetype (npm). Affects @galicia-toolkit-nestjs-20/archetype versions 999.0.1 – 999.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @galicia-toolkit-nestjs-20/archetype package is a toolkit designed for NestJS applications, providing various archetypes and utilities to streamline development. However, it has been found to contain a serious vulnerability that allows for the exfiltration of sensitive environment variables and other system information.
Vulnerability Detail
This vulnerability originates from a malicious binary included in the package, specifically located at prebuilds/<platform>-<arch>/metrics.node. Upon loading the module, the index.js file unconditionally requires this binary, which then reads sensitive environment variables such as AWS_ACCESS_KEY_ID and GITHUB_TOKEN. It sends this information to a hardcoded external server (oob.s4yhii.com) via a raw HTTP POST request. The binary operates in a way that detaches from the host process, making it difficult to detect during runtime. The malicious nature of this code is further emphasized by the absence of any legitimate functionality related to its declared purpose.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @galicia-toolkit-nestjs-20/archetypeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the package from your project until a secure version is released. Use the following command to uninstall the package: npm uninstall @galicia-toolkit-nestjs-20/archetype. Additionally, consider using environment variable management tools to limit exposure of sensitive information.
Conclusion
The @galicia-toolkit-nestjs-20/archetype package contains a serious vulnerability that can lead to the exfiltration of sensitive information. It is essential to monitor for updates and take immediate action to protect your application from potential threats.
See every vulnerability recorded for @galicia-toolkit-nestjs-20/archetype →
FAQ
The vulnerability involves malicious code that exfiltrates sensitive environment variables to an external server.
You can check your application for this vulnerability using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If you have installed the affected package, immediately uninstall it and monitor for updates that address the vulnerability.
As of now, there is no patched version available. Keep an eye on the package repository for updates.
The risks include unauthorized access to sensitive credentials and potential compromise of your application and associated services.
