@zimmo/last_search@99.0.1
Malicious code in @zimmo/last_search (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
@zimmo/last_search@99.0.1: preinstall hook runs index.js which exfiltrates hostname, username, __dirname, and cwd via DNS to oast[.]live (d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg[.]oast[.]live) and HTTP POST to 172[.]201[.]213[.]59:9090. Publisher [account] Dependency-confusion artifact: scoped name + version 99.0.1 + 795B bundle. Error-swallowed via "|| true". Classic host-reconnaissance exfiltration payload — recommend writeup.
- analyzed by
- Leitwacht
- first seen
- Jun 8, 2026, 01:39 PM
- analyzed
- Jun 8, 2026, 01:47 PM
Related advisories
- @nstrlabs/ixel@99.0.1
- @nstrlabs/sdk@99.0.1
- @nstrlabs/utils@99.0.1
- @nstrlabs/shared-components@99.0.0
- events-runtime@3.2.1
- solana-web3-stable@1.0.0
- solana-rpc-client@1.0.0
- solana-web3-patched@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.