@latlongid/location@1.0.1

@latlongid/location@1.0.1 declares `postinstall: node index.js` in package.json, so `index.js` runs automatically on every `npm install`. That script hex-encodes the installer's `os.hostname()` and embeds it as a subdomain of `dns.gl0b.xyz`, then invokes `dns.lookup` on the constructed name (e.g. `2d5bccee-...-h<hex(hostname)>.<rand>.dns.gl0b.xyz`). The DNS query name itself carries the host identifier off the machine, so exfiltration succeeds regardless of resolution result. The scoped name and generic 'internal utility' metadata are consistent with a dependency-confusion reconnaissance beacon designed to enumerate reachable internal build environments.