@baanx/solana-lib@9.9.10

Summary

The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That module reads the installer's username (os.userInfo().username), hostname (os.hostname()), and current working directory basename, concatenates them with a timestamp and the static prefix bxsol, and issues a dns.resolve4() lookup against <prefix>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz — a DNS-based out-of-band beacon that leaks installer identity to a hardcoded non-first-party domain. Helper modules lib/e5f0a2.js and lib/f6a1b3.js reconstruct the strings os, dns, userInfo, hostname, cwd, resolve4, the prefix bxsol, and the destination host oob.algamil7x.xyz from String.fromCharCode byte arrays, and load Node builtins indirectly via module.constructor._load('os') / _load('dns') to conceal the behavior. The package is presented as a Solana library; the char-code-obfuscated destination and the install-time host-recon beacon are inconsistent with any legitimate Solana functionality.

Source: amazon-inspector (6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e)