uploader-frontend-legacy@9.9.11

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

npm install (and any runtime import of index.js)

Leaks local username, hostname, project-directory name, and timestamp to a remote DNS domain.

Obfuscated DNS-based host-fingerprint exfiltration

The install lifecycle runs index.js, which suppresses errors while importing lib/core.js. That obfuscated module obtains the local OS username, hostname, and current working directory basename, then encodes them with a timestamp into a DNS resolve4 query beneath oob.sl4x0.xyz. The same behavior also runs whenever the package main entrypoint is imported.

Concrete install-time, obfuscated host-fingerprint exfiltration is present and unrelated to the advertised utility package. This is malicious behavior, not a benign network helper.