Install-time execution collects local host identifiers and sends them in a DNS query. The behavior is hidden behind obfuscated helper modules and swallowed errors.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install invokes `node index.js`.
Impact
Leaks local username, hostname, project-directory basename, and timestamp to an attacker-controlled DNS suffix.
Mechanism
Obfuscated DNS-based host metadata exfiltration.
Attack narrative
The install hook executes index.js, which imports lib/core.js. That module decodes OS, DNS, and process APIs, gathers a username, hostname, and current working-directory basename, then embeds them with a timestamp in a DNS query beneath oob.sl4x0.xyz. Errors are suppressed, making the exfiltration quiet.
Rationale
This is concrete, unconsented install-time metadata exfiltration concealed by obfuscation, not a package-aligned utility feature.
Evidence
package.jsonindex.jslib/core.jslib/6ad264.jslib/b02e30.jsREADME.md