uploader-frontend@9.9.11

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

npm install via the install lifecycle, or requiring index.js

Leaks local username, hostname, current project-directory name, and timestamp to the operator-controlled domain.

Obfuscated DNS beacon encoding local identity metadata in a subdomain

The install hook executes index.js, which silently requires lib/core.js. That module gathers OS username, hostname, cwd basename, and time, constructs an encoded DNS name under oob.sl4x0.xyz, and resolves it. The same beacon also runs on ordinary package import.

This is concrete, obfuscated install/import-time metadata exfiltration, unrelated to the advertised utility package. The generic network helper does not mitigate the malicious DNS beacon.