@tvg-mar/utils@9.9.10

Summary

package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstructs Node core APIs ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd', 'resolve4') and its destination domain from hex/char-code arrays at runtime, reads os.userInfo().username, os.hostname(), and process.cwd(), and encodes those values as labels of a subdomain under oob.algamil7x.xyz queried via dns.resolve4 — a DNS out-of-band exfiltration channel that fires automatically on npm install. Method names and the destination host are split across sibling files (d5a8c1.js, e6b9d2.js) and disguised with cover-story comments describing a benign 'registry mirror connectivity probe'.

Source: amazon-inspector (de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab)