qr-code-styling-temp@9.9.11

The package's `install` lifecycle script (`node index.js`) and its main entry both load `lib/core.js`, which reads `os.userInfo().username`, `os.hostname()`, and the current working directory basename and encodes them into a subdomain of `oob.sl4x0.xyz`, then triggers a `dns.resolve4` lookup of `samsung.<user>.<host>.<cwd>.<ts>.oob.sl4x0.xyz`. This is an out-of-band DNS exfiltration beacon that fires on every `npm install` and on every `require()` of the package, leaking installer identity to an attacker-controlled domain. Module names (`os`, `dns`, `process`, `userInfo`, `hostname`, `resolve4`) and the C2 domain are hidden as `String.fromCharCode` charcode arrays in lib/b02e30.js and lib/6ad264.js, with `os` and `dns` loaded via `module.constructor._load(...)` to evade static `require` scanners. The package name impersonates the popular `qr-code-styling` library but ships an unrelated API surface, and the author email `research@sl4x0.xyz` shares the same domain as the exfiltration host — confirming the typosquat lure and attacker-controlled infrastructure.