@shared-web/assets@9.9.10

Summary

The package runs an install lifecycle script (node index.js) and also executes ./lib/core.js on require. That code collects os.userInfo().username, os.hostname(), and process.cwd() and issues a DNS resolve4 for a label chain of the form <pkg>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz, exfiltrating installer identity and working-directory information over DNS to an attacker-controlled domain. The destination host and the os/dns/process module names are obfuscated in lib/c5df9a.js and lib/b4ce8f.js using char-code byte arrays (String.fromCharCode) and loaded via module.constructor._load instead of plain require, concealing both the APIs and the C2 destination. The obfuscation and DNS-label-encoded channel are inconsistent with the package's presentation as a shared web assets helper.

Source: amazon-inspector (e8fd9342e97dc9f655a994fe1091125f717cbfa7b89aa6a2333662ad23ad6771)