MAL-2026-5422

Dashboard / Malicious Package / MAL-2026-5422

MAL-2026-5422

Summary: Malicious code in @nstrlabs/shared-components (npm)

Details: Source: amazon-inspector (efc72373a5a06d31becb2dd02ced949866c9da14ae6d0bfdb3b4f4c882e40445) On `npm install`, the package's preinstall script runs index.js, which collects host identifiers (os.hostname(), os.userInfo().username, __dirname, process.cwd(), package name) and ships them to two attacker-controlled destinations: (1) a hex-encoded DNS subdomain query against `*.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live` (Interactsh-style out-of-band exfiltration), and (2) an HTTP POST of the same JSON payload to bare IP `http://172.201.213.59:9090/c`. The package is published under `@nstrlabs/shared-components` at version `99.0.0` with description `security research` — a high semver against a generic scoped name consistent with a dependency-confusion attack targeting an internal `nstrlabs` namespace. There is no legitimate library functionality; the preinstall beacon is the package's only effect.

References: https://www.npmjs.com/package/@nstrlabs/shared-components/v/99.0.1, https://www.npmjs.com/package/@nstrlabs/shared-components/v/99.0.0