OpenSSF/OSV advisory MAL-2026-14207 confirms this npm version as malicious. The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basename to the hardcoded attacker-controlled domain oob.sl4x0.xyz. lib/core.js collects os.userInfo().username, os.hostname(), and process.cwd(), joins them as subdomain labels under oob.sl4x0.xyz, and issues a dns.resolve4() lookup so the encoded values are exfiltrated via DNS...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @sarex-team/viewer (npm)
Details
The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basename to the hardcoded attacker-controlled domain oob.sl4x0.xyz. lib/core.js collects os.userInfo().username, os.hostname(), and process.cwd(), joins them as subdomain labels under oob.sl4x0.xyz, and issues a dns.resolve4() lookup so the encoded values are exfiltrated via DNS. The destination domain and the module/API names ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd', 'resolve4') are reconstructed from numeric char-code arrays in lib/b02e30.js and lib/6ad264.js solely to conceal them. Execution is zero-interaction: package.json declares scripts.install: 'node index.js', and index.js top-level requires./lib/core inside a try/catch that swallows errors, so the beacon fires on npm install and again on every require() of the package while the install appears clean.
Decision reason
One or more suspicious static signals were detected.