{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.1.2","last_affected":"0.1.19"}],"component":"@beproduct/nestjs-auth","cve_ids":["CVE-2026-46412"],"ecosystem":"npm","epss":0.00765,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-6xwp-cp5h-q856","id":"tcs_01M5KF8BSH7XRNCGG0S0KGN5T2","modified_at":"2026-09-10T03:50:45.795205720Z","published_at":"2026-05-19T20:28:07Z","references":["https://osv.dev/vulnerability/GHSA-6xwp-cp5h-q856","https://github.com/BeProduct/beproduct-org-nestjs-auth/security/advisories/GHSA-6xwp-cp5h-q856","https://github.com/BeProduct/beproduct-org-nestjs-auth","https://www.aikido.dev/blog/checklist-github-actions","https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-6xwp-cp5h-q856","url":"https://osv.dev/vulnerability/GHSA-6xwp-cp5h-q856"}],"summary":"Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm"}