Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-46412 · Microsoft / collected KEV context

GHSA-6xwp-cp5h-q856

cve-program · CVE-2026-46412

• https://github.com/BeProduct/beproduct-org-nestjs-auth/security/advisories/GHSA-6xwp-cp5h-q856
• https://www.aikido.dev/blog/checklist-github-actions
• https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised

nvd · CVE-2026-46412

• https://github.com/BeProduct/beproduct-org-nestjs-auth/security/advisories/GHSA-6xwp-cp5h-q856
• https://www.aikido.dev/blog/checklist-github-actions
• https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised

osv · GHSA-6xwp-cp5h-q856

• https://github.com/BeProduct/beproduct-org-nestjs-auth/security/advisories/GHSA-6xwp-cp5h-q856
• https://github.com/BeProduct/beproduct-org-nestjs-auth
• https://www.aikido.dev/blog/checklist-github-actions
• https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised

No related operational record is retained in the current change model.