Critical Malicious Code Vulnerability in @galicia-toolkit-nestjs/archetype Package
Summary
MAL-2026-17721: Malicious code in @galicia-toolkit-nestjs/archetype (npm). Affects @galicia-toolkit-nestjs/archetype versions 999.0.1 – 999.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @galicia-toolkit-nestjs/archetype package is an npm library designed for use with NestJS applications. It provides various archetypes and utilities to streamline development. However, it has been found to contain malicious code that poses significant security risks, particularly in CI/CD environments.
Vulnerability Detail
The vulnerability originates from a malicious native ELF addon included in the package, which is loaded upon requiring the package. This addon is capable of reading sensitive environment variables such as AWS and GitHub credentials and sending them to an attacker-controlled server. The malicious code also detaches itself from the parent process, allowing it to persist even after the Node.js application has terminated. This poses a severe risk of credential leakage and unauthorized access to cloud resources.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @galicia-toolkit-nestjs/archetypeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the @galicia-toolkit-nestjs/archetype package from your project until a secure version is confirmed. You can do this by executing:
npm uninstall @galicia-toolkit-nestjs/archetype
Additionally, review your CI/CD pipelines to ensure that sensitive environment variables are not exposed.
Conclusion
The @galicia-toolkit-nestjs/archetype package has a critical vulnerability that allows malicious code to extract sensitive credentials. It is essential to update or remove the package to protect your application from potential exploits. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for @galicia-toolkit-nestjs/archetype →
FAQ
The malicious code is a native ELF addon that reads sensitive environment variables and sends them to an external server.
You can use Vulert, which monitors vulnerabilities in open-source packages. By checking your package-lock.json file, you can receive real-time alerts about vulnerabilities.
Immediately update the package to the latest version or remove it from your project to prevent potential credential leakage.
Yes, the vulnerability allows attackers to gain access to sensitive credentials, which could lead to unauthorized access to cloud services and repositories.
You can use Vulert's playground to check for vulnerabilities in your application without needing to sign up. It provides real-time monitoring based on your package-lock.json.
