quartz-core@99.1.9

Summary

On npm install, the package's preinstall hook (package.json scripts.preinstall = node index.js) executes index.js, which reads the installer's OS username (os.userInfo().username), hostname (os.hostname()), and current working directory (process.cwd()), then issues a DNS A-record query for a subdomain of the attacker-controlled domain oob.algamil7x.xyz of the form selftest.<username>.<hostname>.<cwd>.<timestamp>.oob.algamil7x.xyz via dns.Resolver.resolve4. The tarball ships no other functionality: package.json has an empty description and author, no dependencies, and no runtime code beyond the beacon. The name quartz-core at the elevated version 99.1.9 is consistent with a dependency-confusion reconnaissance probe designed to identify internal build environments where a private package name resolves to this public one.

Source: amazon-inspector (8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91)