@sapappgyver/appgyver-descriptors@9.9.11

Summary

The package declares an install lifecycle script that runs node index.js, which requires lib/core.js; the same module is the package main, so the payload also fires on any require() of the package. lib/core.js reads the installer's OS username, hostname, and current working-directory basename and encodes them as labels of a DNS subdomain under oob.sl4x0.xyz, then issues a dns.resolve4 lookup — leaking host and user identity to an author-controlled authoritative resolver. Sibling files lib/b02e30.js and lib/6ad264.js hide the module names (os, dns, process), the property names (userInfo, hostname, cwd, resolve4), and the destination host oob.sl4x0.xyz as arrays of char-code hex literals reconstructed with String.fromCharCode at runtime. The package name @sapappgyver/appgyver-descriptors is crafted to visually match SAP's legitimate @sap/appgyver-* scope; the repository github.com/slaxorg/nms-dashboard-js and author email research@sl4x0.xyz have no relation to SAP and align with the exfil domain.

Source: amazon-inspector (f9396712a6bf4b08219d9ed2066ebf8c25a7558b988b6d9bf1c9ae57349a4741)