nms-dashboard-js@9.9.11

Summary

nms-dashboard-js@9.9.11 declares an npm install lifecycle hook (scripts.install: "node index.js") that unconditionally requires ./lib/core inside a swallow-all try/catch. The loaded code reads os.userInfo().username, os.hostname(), and the basename of process.cwd(), concatenates them with a timestamp into a subdomain of oob.sl4x0.xyz, and issues a dns.resolve4 lookup, exfiltrating installer host identifiers via DNS out-of-band. The destination domain and the API/property names (os, dns, userInfo, hostname, cwd, resolve4, oob.sl4x0.xyz) are reconstructed at runtime from hex char-code arrays in lib/b02e30.js and lib/6ad264.js to conceal the sink. The beacon also fires on any require() of the package, not only on install. The advertised purpose ("enterprise utilities") does not require any such network activity.

Source: amazon-inspector (ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601)