@sapappgyver/appgyver-descriptors @9.9.11

Summary

The package declares an install lifecycle script that runs node index.js , which requires lib/core.js ; the same module is the package main, so the payload also fires on any require() of the package. lib/core.js reads the installer's OS username, hostname, and current working-directory basename and encodes them as labels of a DNS subdomain under oob.sl4x0.xyz , then issues a dns.resolve4 lookup — leaking host and user identity to an author-controlled authoritative resolver. Sibling files lib/b02e30.js and lib/6ad264.js hide the module names ( os , dns , process ), the property names ( userInfo , hostname , cwd , resolve4 ), and the destination host oob.sl4x0.xyz as arrays of char-code hex literals reconstructed with String.fromCharCode at runtime. The package name @sapappgyver/appgyver-descriptors is crafted to visually match SAP's legitimate @sap/appgyver-* scope; the repository github.com/slaxorg/nms-dashboard-js and author email research@sl4x0.xyz have no relation to SAP and align with the exfil domain.

Source: amazon-inspector (f9396712a6bf4b08219d9ed2066ebf8c25a7558b988b6d9bf1c9ae57349a4741)