@nstrlabs/ixel@99.0.1
Malicious code in @nstrlabs/ixel (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
@nstrlabs/ixel@99.0.1 is a 787-byte dependency-confusion stub whose preinstall runs index.js to exfiltrate hostname, username, cwd and dirname via two channels: a DNS tunnel to oast[.]live (hex-encoded subdomain labels) and an HTTP POST to 172[.]201[.]213[.]59:9090/c. The 'security research' description is an unverifiable self-claim (no repo, no program reference) masking a host-reconnaissance beacon.
- analyzed by
- Leitwacht
- first seen
- Jun 8, 2026, 01:39 PM
- analyzed
- Jun 8, 2026, 01:47 PM
Related advisories
- @nstrlabs/api-client@99.0.1
- @nstrlabs/sdk@99.0.1
- @nstrlabs/utils@99.0.1
- @nstrlabs/shared-components@99.0.0
- events-runtime@3.2.1
- solana-web3-stable@1.0.0
- solana-rpc-client@1.0.0
- solana-web3-patched@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.