uploader-frontend-legacy @9.9.11

Summary

The package's scripts.install runs node index.js , which loads lib/core.js and issues a dns.resolve4 query against a subdomain of oob.sl4x0.xyz constructed from os.userInfo().username , os.hostname() , and process.cwd() , along with a package tag and timestamp. Module names ( os , dns , process ), API names ( userInfo , hostname , cwd , resolve4 ), and the destination domain oob.sl4x0.xyz are assembled from String.fromCharCode byte arrays in lib/b02e30.js , lib/6ad264.js , and lib/core.js to hide the behavior from casual review. The net effect on npm install is an outbound DNS beacon carrying installer-identifying data to an author-controlled out-of-band listener.

Source: amazon-inspector (0e90aa99bc8b8e4bb886e911c1fe5ffbddd1d7e730088105118db47170b66681)