uploader-frontend @9.9.11

Summary

The package's scripts.install runs node index.js , which loads ./lib/core and, on npm install , collects the installer's OS username (via os.userInfo().username ), hostname ( os.hostname() ), and current working directory basename, encodes them as a subdomain, and issues a dns.resolve4 lookup against the hardcoded attacker domain oob.sl4x0.xyz — a DNS out-of-band beacon that exfiltrates installer identity. The require targets ( dns , os , process ), the API names ( userInfo , username , hostname , cwd , resolve4 ), and the destination domain are reconstructed at runtime from String.fromCharCode numeric arrays to hide the destination and the APIs used. Package name and README advertise uploader-frontend / enterprise utilities and validation, but the auto-executed code implements no such functionality — only the beacon. The author email research@sl4x0.xyz shares the domain of the exfil host, and homepage points at an unrelated project ( github.com/slaxorg/nms-dashboard-js ), indicating publisher-controlled attacker infrastructure.

Source: amazon-inspector (434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911)