zystcdemo

Details

zystcdemo presents itself as a simple date formatting utility and runs its postinstall payload on npm install with `node postinstall.js`. The payload collects the `whoami` result, hostname, platform, and current time, then sends them in a POST request to `https://srctest.zystcc.cn/collect`; npm account `zyst` published it on 2026-10-29 (UTC).

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.