OpenSSF/OSV advisory MAL-2026-13348 confirms this npm version as malicious. lakk-analytics@9.9.11 runs `node index.js` from an npm install lifecycle hook, which loads `./lib/core` and constructs a subdomain from the installer's OS username, hostname, and current working directory (with a timestamp and the static prefix `asnbank`), then issues a `dns.resolve4()` query against `<prefix>.<user>.<host>.<cwd>.<ts>.oob.sl4x0.xyz`...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in lakk-analytics (npm)
Details
lakk-analytics@9.9.11 runs `node index.js` from an npm install lifecycle hook, which loads `./lib/core` and constructs a subdomain from the installer's OS username, hostname, and current working directory (with a timestamp and the static prefix `asnbank`), then issues a `dns.resolve4()` query against `<prefix>.<user>.<host>.<cwd>.<ts>.oob.sl4x0.xyz`. This leaks installer identity via DNS to an out-of-band canary domain on every install. The destination host `oob.sl4x0.xyz` and API surface (`os`, `dns`, `process`, `userInfo`, `hostname`, `cwd`) are hidden as hex code-point arrays reconstructed with `String.fromCharCode` in sibling modules `lib/b02e30.js` and `lib/6ad264.js`. The README explicitly claims 'No network requests', which directly contradicts the observed install-time DNS beacon.
Decision reason
One or more suspicious static signals were detected.