@nstrlabs/api-client@99.0.1
Malicious code in @nstrlabs/api-client (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
@nstrlabs/api-client@99.0.1 is a tiny (646-byte) dependency-confusion stub whose preinstall hook (node index.js || true, error-swallowed) collects hostname, username, cwd and dirname, encodes them as JSON, and exfiltrates via two channels: a DNS query to a subdomain of d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast[.]live and an HTTP POST to 172[.]201[.]213[.]59:9090/c. The unverifiable 'security research' description (no repo, README or program link) masks an information-stealing beacon.
- analyzed by
- Leitwacht
- first seen
- Jun 8, 2026, 01:39 PM
- analyzed
- Jun 8, 2026, 01:48 PM
Related advisories
- @nstrlabs/ixel@99.0.1
- @nstrlabs/sdk@99.0.1
- @nstrlabs/utils@99.0.1
- @klapp-kyc/routes@99.0.1
- @zimmo/last_search@99.0.1
- @nstrlabs/shared-components@99.0.0
- events-runtime@3.2.1
- solana-web3-stable@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.