Malicious code in @nestjs-passport/jwt (npm)

A malicious npm package named @nestjs-passport/jwt was published under the @nestjs-passport scope, designed to resemble the official @nestjs/jwt and @nestjs/passport packages. This is a typosquatting attack targeting developers seeking JWT authentication utilities for NestJS.

The package's sole entrypoint files (dist/index.cjs and dist/index.js) contain a single-line JSFuck-encoded string approximately 2.3MB in size, consisting of permutations of JavaScript operators (!+[], !![], +[]). This obfuscated code is passed to new Function('jose', ) and invoked at require/import time, executing hidden code within the installer's Node process every time the module is loaded.

The package advertises itself as a minimal HS256 JWT helper, a task that would normally require only a few lines of jose library calls. However, the shipped TypeScript declarations expose obfuscated private field names such as _0x5f2e and _0x4b19, which are inconsistent with the declared tsup build tooling, indicating intentional obfuscation rather than legitimate compilation artifacts.

The combination of scope-level typosquatting, whole-module JSFuck obfuscation, and dynamic evaluation of the obfuscated payload at import time creates a concealment-and-execution vehicle that allows arbitrary code to run inside the installer's process without any readable code path for detection.