@an1mshnpmb9c84920/pipe-dns-m19t2@1.0.0

Summary

The package's prepare lifecycle script executes index.js, which builds a subdomain string from the installer's hostname and the npm lifecycle event name and issues a dns.lookup against npmexec19t2--768.oob.awss.dev, an authoritative zone controlled by the publisher. This leaks installer identity to an external party automatically on npm install via an out-of-band DNS channel. The package.json repository field points at a sibling host on the same oob.awss.dev infrastructure, and the README contains only the word 'owned', with no legitimate functionality shipped in the tarball.

Source: amazon-inspector (548a4b4d6c63df4cc62bd7e753758dc32f98b3ed9adb7fbee204493838614eea)