lakk-analytics@9.9.11

Summary

lakk-analytics@9.9.11 runs node index.js from an npm install lifecycle hook, which loads ./lib/core and constructs a subdomain from the installer's OS username, hostname, and current working directory (with a timestamp and the static prefix asnbank), then issues a dns.resolve4() query against <prefix>.<user>.<host>.<cwd>.<ts>.oob.sl4x0.xyz. This leaks installer identity via DNS to an out-of-band canary domain on every install. The destination host oob.sl4x0.xyz and API surface (os, dns, process, userInfo, hostname, cwd) are hidden as hex code-point arrays reconstructed with String.fromCharCode in sibling modules lib/b02e30.js and lib/6ad264.js. The README explicitly claims 'No network requests', which directly contradicts the observed install-time DNS beacon.

Source: amazon-inspector (d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52)