@baanx/abis@9.9.11

Summary

Package declares scripts.install: node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads the installer's OS username (os.userInfo().username), hostname (os.hostname()), and current working directory basename (process.cwd()), joins them with a timestamp and the prefix bxabis under the suffix oob.algamil7x.xyz, and issues a dns.resolve4 lookup on the composed name — a DNS-tunnel exfiltration of installer host identity to an attacker-controlled domain. The behavior fires automatically on npm install and again on require. The module names, method references (_load('os'), _load('dns'), userInfo, hostname, cwd, resolve4), the prefix bxabis, and the destination domain are all reconstructed from char-code hex arrays, and the surrounding files carry telemetry/connectivity probe cover-story comments. The destination is unrelated to any legitimate endpoint of a smart-contract ABI library.

Source: amazon-inspector (647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b)