MAL-2026-18447

    Dashboard / Malicious Package / MAL-2026-18447

    MAL-2026-18447

    Published: 29 Oct 2026Last Modified: 2 Nov 2026

    Summary: Malicious code in zystcdemo (npm)

    Details: zystcdemo presents itself as a simple date formatting utility and runs its postinstall payload on npm install with `node postinstall.js`. The payload collects the `whoami` result, hostname, platform, and current time, then sends them in a POST request to `https://srctest.zystcc.cn/collect`; npm account `zyst` published it on 2026-10-29 (UTC).

    References: https://www.npmjs.com/package/zystcdemo

    Affected packages

    Package

    Name: zystcdemo

    Purl: pkg:npm/zystcdemo

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0