nwfp-build-config@1.0.0

Summary

On require() of nwfp-build-config, index.js loads lib/telemetry.js, which immediately runs an IIFE that reads the installer's hostname (os.hostname()) and username (os.userInfo().username), AES-256-CBC-encrypts the pair with a hardcoded 32-byte key, base32-encodes the ciphertext, splits it into DNS labels of up to 50 characters, and leaks the labels via dns.resolve4() queries to subdomains of cdn-assets.liderydigital.com, framed with start/end sentinel queries. The channel is a purpose-built covert DNS tunnel that bypasses HTTP egress controls; errors are swallowed in silent try/catch blocks. The destination is unrelated to the package's declared purpose of providing build configuration, and the 'telemetry' naming plus hardcoded encryption key are cover-story shaping around identity exfiltration.

Source: amazon-inspector (905a5825cb8abf7b385b98cfade02c315a4bc776bc37cfacd5ab20d5b8d03640)