@insiderintelligence/googleadmanager@9.9.10

The package's `install` lifecycle script runs `node index.js`, which loads `lib/core.js`. On install, that module collects `os.userInfo().username`, `os.hostname()`, and the basename of the current working directory, then issues a `dns.resolve4` for a subdomain composed of those values under the hardcoded external domain `oob.algamil7x.xyz`. Module loads and the destination hostname are hex-array obfuscated: `lib/g7h8i9.js` uses `module.constructor._load` with hex-decoded strings to require `os`, `dns`, and `process`, and `lib/h8i9j0.js` stores the destination as hex arrays that decode to `oob.algamil7x.xyz`. The package name typosquats a legitimate ad-tech scope, and no functionality matching that stated purpose is present — the install-time DNS beacon is the package's only observable behavior.