banana-stand@9.9.11

On `npm install`, the package's `install` lifecycle hook runs `node index.js`, which loads `lib/core.js`. That module reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`, then issues a `dns.resolve4` lookup for `lwbanana.<username>.<hostname>.<cwd>.<unixtime>.oob.sl4x0.xyz`, smuggling host identifiers out-of-band via DNS to an author-controlled domain. The same path also fires on `require('banana-stand')` because `main` points at the same entry. Strings used to construct the exfil (`os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`, and the destination domain `oob.sl4x0.xyz`) are concealed as `String.fromCharCode` byte arrays in `lib/6ad264.js` and `lib/b02e30.js` and decoded at runtime, indicating intentional concealment of the exfiltration channel.