If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
zystcdemo presents itself as a simple date formatting utility and runs its postinstall payload on npm install with `node postinstall.js`. The payload collects the `whoami` result, hostname, platform, and current time, then sends them in a POST request to `https://srctest.zystcc.cn/collect`; npm account `zyst` published it on 2026-10-29 (UTC).
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- srctest[.]zystcc[.]cn other packages →
URLs
- hxxps://srctest[.]zystcc[.]cn/collect other packages →
IP addresses
- 49[.]233[.]127[.]33 other packages →