Install and normal import execute a concealed DNS telemetry collector. It transmits host-derived identifiers in a DNS query.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install or requiring the package entrypoint
Impact
Leaks local username, hostname, project-directory basename, and timestamp to a third-party DNS domain.
Mechanism
obfuscated hostname-based DNS exfiltration
Attack narrative
The install lifecycle invokes index.js, which silently loads lib/core.js. That module decodes obfuscated identifiers, reads the current OS username, hostname, and working-directory basename, then embeds them with a timestamp in a DNS label resolved under oob.sl4x0.xyz. The same collector also runs when consumers import the package.
Rationale
This is concealed, automatic host-data exfiltration at install/import time, unrelated to the advertised utilities.
Evidence
package.jsonindex.jslib/core.jslib/b02e30.jslib/6ad264.js