MAL-2026-5421

    Dashboard / Malicious Package / MAL-2026-5421

    MAL-2026-5421

    Published: 9 Jun 2026Last Modified: 9 Jun 2026

    Summary: Malicious code in @nstrlabs/sdk (npm)

    Details: Source: amazon-inspector (a0b1375de7b44594cd3760efb91cb94c8c8b7137322f4597114e314ce5e14e45) On `npm install`, package.json runs `preinstall: node index.js || true`, unconditionally executing index.js. The script collects host identity fields (os.hostname(), os.userInfo().username, __dirname, process.cwd(), and the package id), hex-encodes them as DNS labels, and resolves them as a subdomain of an interactsh OOB callback host (`*.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live`), then also POSTs the same JSON payload to a bare IP HTTP endpoint at `http://172.201.213.59:9090/c`. Two independent exfiltration channels (DNS + HTTP) fire on every install, with `|| true` swallowing errors so the exfil is silent. The package is a typosquat / dependency-confusion lure: version `99.0.1` is an unusually high pseudo-version, scope `@nstrlabs` and metadata (`description: security research`, author `jeroengui`) are placeholder-shaped, and the package has no other functionality — its sole effect on install is the recon beacon.

    References: https://www.npmjs.com/package/@nstrlabs/sdk/v/99.0.1, https://www.npmjs.com/package/@nstrlabs/sdk/v/99.0.0

    Affected packages

    Package

    Name: @nstrlabs/sdk

    Purl: pkg:npm/%40nstrlabs%2Fsdk

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.1
    99.0.0