@nstrlabs/shared-components@99.0.0
Malicious code in @nstrlabs/shared-components (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
Dependency-confusion hijack: @nstrlabs/shared-components@99.0.0 is a 623-byte stub at sentinel version 99.0.0 with no prior versions and a preinstall hook (node index.js || true). index.js exfiltrates hostname, username, and cwd via DNS to the oast[.]live OOB interaction channel and via HTTP POST to 172[.]201[.]213[.]59:9090. Direct-IP exfil and an OOB DNS channel; the '|| true' masks failures.
- analyzed by
- Leitwacht
- first seen
- Jun 8, 2026, 01:39 PM
- analyzed
- Jun 8, 2026, 01:45 PM
Related advisories
- @nstrlabs/api-client@99.0.1
- @nstrlabs/ixel@99.0.1
- @nstrlabs/sdk@99.0.1
- events-runtime@3.2.1
- solana-web3-stable@1.0.0
- solana-rpc-client@1.0.0
- solana-web3-patched@1.0.0
- solana-web3-fixed@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.