consumerweb-risk @3.4.3

Summary

The package's preinstall lifecycle script runs automatically on npm install. It collects the installer's OS username (os.userInfo().username), hostname (os.hostname()), and current working directory (process.cwd()), serializes them to JSON, hex-encodes the payload, chunks it into DNS subdomain labels, and issues dns.lookup() queries against an attacker-controlled nameserver under jgl.red. The lookups themselves carry the encoded host identity out to the attacker's authoritative DNS server, forming a covert DNS-tunnel exfiltration channel that fires on every install regardless of whether the module is ever required.

Source: amazon-inspector (aa886e4b335d3fc76fa6bc8e50c2e428ac164165830705c0ab2847857c2b3aa7)