qr-code-styling-temp@9.9.11

Summary

The package's install lifecycle script (node index.js) and its main entry both load lib/core.js, which reads os.userInfo().username, os.hostname(), and the current working directory basename and encodes them into a subdomain of oob.sl4x0.xyz, then triggers a dns.resolve4 lookup of samsung.<user>.<host>.<cwd>.<ts>.oob.sl4x0.xyz. This is an out-of-band DNS exfiltration beacon that fires on every npm install and on every require() of the package, leaking installer identity to an attacker-controlled domain. Module names (os, dns, process, userInfo, hostname, resolve4) and the C2 domain are hidden as String.fromCharCode charcode arrays in lib/b02e30.js and lib/6ad264.js, with os and dns loaded via module.constructor._load(...) to evade static require scanners. The package name impersonates the popular qr-code-styling library but ships an unrelated API surface, and the author email research@sl4x0.xyz shares the same domain as the exfiltration host — confirming the typosquat lure and attacker-controlled infrastructure.

Source: amazon-inspector (004a5cc51cc0e38448c56189fb4437ad113eec163f7ae1a7692b88d6aed71182)