@tvg-mar/promos-context@9.9.10

Summary

The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module dynamically resolves the os and dns core modules via module.constructor._load with char-code-obfuscated names, reads os.userInfo().username, os.hostname(), and the basename of process.cwd(), and encodes them as DNS labels in a dns.resolve4 query to oob.algamil7x.xyz. The destination domain is reconstructed at runtime from a hex char-code array in runtime/support/telemetry/probe/d4c8a1.js / e5d9b2.js rather than appearing as a plain string. The combination of an install-time hook, obfuscated core-module loading, obfuscated destination, and DNS-tunnel encoding of installer identity fields is a classic install-time exfiltration beacon.

Source: amazon-inspector (68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3)