digitalexp-style-module-l9 @99.0.0

Summary

package.json declares both preinstall and postinstall as node beacon.js , so beacon.js runs automatically on every npm install . beacon.js reads os.hostname(), os.userInfo().username, process.cwd(), and the package name, hex-encodes the collected string, splits it into <=60-char DNS labels, and issues a DNS lookup against those labels under the author-controlled domain b0.rs. It additionally issues an HTTPS GET to https://b0.rs/?poc=...&host=...&cwd=... carrying the same fields in the query string. A source comment identifies the DNS-tunnel channel as chosen for its 'best chance of escaping egress-filtered CI', confirming the dual-channel design is intentional evasion. The version number 99.0.0 is consistent with a dependency-confusion payload targeting internal-scope name resolution.

Source: amazon-inspector (4c1b3e9059995d4d535c65fafd0105eea420510acb17ad9befbc99c18aa25df9)