@latlongid/location @1.0.1

Summary

@latlongid/location@1.0.1 declares postinstall: node index.js in package.json, so index.js runs automatically on every npm install . That script hex-encodes the installer's os.hostname() and embeds it as a subdomain of dns.gl0b.xyz , then invokes dns.lookup on the constructed name (e.g. 2d5bccee-...-h<hex(hostname)>.<rand>.dns.gl0b.xyz ). The DNS query name itself carries the host identifier off the machine, so exfiltration succeeds regardless of resolution result. The scoped name and generic 'internal utility' metadata are consistent with a dependency-confusion reconnaissance beacon designed to enumerate reachable internal build environments.

Source: amazon-inspector (134cf39570bebc6b10043353b9194b41e30da9b0f55147501ccc060bb32c7e8e)