nms-dashboard-js @9.9.11

Summary

nms-dashboard-js@9.9.11 declares an npm install lifecycle hook ( scripts.install: "node index.js" ) that unconditionally requires ./lib/core inside a swallow-all try/catch. The loaded code reads os.userInfo().username , os.hostname() , and the basename of process.cwd() , concatenates them with a timestamp into a subdomain of oob.sl4x0.xyz , and issues a dns.resolve4 lookup, exfiltrating installer host identifiers via DNS out-of-band. The destination domain and the API/property names ( os , dns , userInfo , hostname , cwd , resolve4 , oob.sl4x0.xyz ) are reconstructed at runtime from hex char-code arrays in lib/b02e30.js and lib/6ad264.js to conceal the sink. The beacon also fires on any require() of the package, not only on install. The advertised purpose ("enterprise utilities") does not require any such network activity.

Source: amazon-inspector (ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601)