@nstrlabs/utils@99.0.1
Malicious code in @nstrlabs/utils (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
@nstrlabs/utils@99.0.1 is a 642-byte dependency-confusion stub (scoped name, version 99) whose preinstall exfiltrates hostname, username, cwd and path via a DNS tunnel to oast[.]live and an HTTP POST to 172[.]201[.]213[.]59:9090. The unverifiable 'security research' description (no repo URL or program reference) masks a host-metadata stealer.
- analyzed by
- Leitwacht
- first seen
- Jun 8, 2026, 01:39 PM
- analyzed
- Jun 8, 2026, 01:45 PM
Related advisories
- @nstrlabs/api-client@99.0.1
- @nstrlabs/ixel@99.0.1
- @nstrlabs/sdk@99.0.1
- @nstrlabs/shared-components@99.0.0
- events-runtime@3.2.1
- solana-web3-stable@1.0.0
- solana-rpc-client@1.0.0
- solana-web3-patched@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.