GCVE-110-OSM-2026-12280

The package's `install` lifecycle script runs `node index.js`, which loads `lib/core.js`. On install, that module collects `os.userInfo().username`, `os.hostname()`, and the basename of the current working directory, then issues a `dns.resolve4` for a subdomain composed of those values under the hardcoded external domain `oob.algamil7x.xyz`. Module loads and the destination hostname are hex-array obfuscated: `lib/g7h8i9.js` uses `module.constructor._load` with hex-decoded strings to require `os`, `dns`, and `process`, and `lib/h8i9j0.js` stores the destination as hex arrays that decode to `oob.algamil7x.xyz`. The package name typosquats a legitimate ad-tech scope, and no functionality matching that stated purpose is present — the install-time DNS beacon is the package's only observable behavior. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in lib/g7h8i9.js ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing