zystcdemo (npm): malicious postinstall payload exfiltrates host info to srctest.zystcc.cn on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
The npm package zystcdemo, published by account 'zyst' on 2026-10-29, poses as a simple date formatting utility but contains malicious code flagged by OpenSSF and added to the GitHub Advisory Database (GHSA-xpgj-8rc5-pq44, CWE-506) on 2026-11-02. Version 1.0.0 runs a postinstall script (node postinstall.js) during npm install, collecting the whoami result, hostname, platform, and current time, and POSTing them to https://srctest.zystcc.cn/collect. Any developer or CI system that installs the package executes the payload automatically. There are no patched versions; the package is malware and should be removed entirely. Affected users should audit for the package and any data sent to the collection endpoint.
What to do
- Search dependency trees, lockfiles, and CI caches for zystcdemo@1.0.0 and remove it; do not install
- Check install logs and network/proxy logs for connections to srctest.zystcc.cn/collect
- Treat any machine or CI runner that installed it as compromised; review exposed user/host information
- Rotate credentials if whoami/hostname data could enable targeted follow-up attacks
- Block the domain srctest.zystcc.cn at egress
Sources
All live incidents on Threat Watch
