MAL-2026-5423

    Dashboard / Malicious Package / MAL-2026-5423

    MAL-2026-5423

    Published: 9 Jun 2026Last Modified: 9 Jun 2026

    Summary: Malicious code in @nstrlabs/utils (npm)

    Details: Source: amazon-inspector (36d8d7c327560bb7a4c08d906db240a2dc146e20f828d9dfc5ab79497b155355) On `npm install`, the package's `preinstall` script (`node index.js || true`) executes automatically and collects host identifiers from the installer's machine — `os.hostname()`, `os.userInfo().username`, `__dirname`, and `process.cwd()` — then exfiltrates them through two channels. First, the JSON payload is POSTed to a hardcoded bare IP `http://172.201.213.59:9090/c`. Second, the data is hex-encoded into a subdomain and resolved via DNS against `*.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live`, an Interactsh out-of-band beacon. The `|| true` suffix swallows any error so the install always succeeds silently. Although the package metadata describes itself as 'security research', every installer is harmed: host reconnaissance fires unconditionally on install with no opt-out and no disclosure.

    References: https://www.npmjs.com/package/@nstrlabs/utils/v/99.0.1, https://www.npmjs.com/package/@nstrlabs/utils/v/99.0.0

    Affected packages

    Package

    Name: @nstrlabs/utils

    Purl: pkg:npm/%40nstrlabs%2Futils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.1
    99.0.0
    MAL-2026-5423 | CVE-DB