MAL-2026-13627 Malicious code in @nestjs-passport/jwt (npm)

Package published under the @nestjs-passport scope, which resembles the official @nestjs/jwt and @nestjs/passport packages. The sole entrypoint files dist/index.cjs and dist/index.js each consist of a single-line JSFuck-encoded string (~2.3MB of permutations of!+[],!![], +[]) that is passed to new Function('jose', <opaque body>) and invoked at require/import time, executing hidden code in the installer's Node process every time the module is loaded. The advertised purpose is a minimal HS256 JWT helper — a task requiring only a few lines of jose calls — and the shipped TypeScript declarations expose obfuscated private field names such as _0x5f2e and _0x4b19, inconsistent with the declared tsup build tooling. The combination of scope-level typosquat, whole-module JSFuck obfuscation, and dynamic evaluation of the obfuscated body at import time is a concealment-and-execution vehicle: whatever behavior the payload performs runs inside the installer's process without any traced-readable code path.