GCVE-110-OSM-2026-12282

package.json declares scripts.install: node index.js, which loads lib/core.js. On npm install, that module reads os.userInfo().username, os.hostname(), and the current working directory basename, concatenates them with a fixed 'swutils' prefix and a timestamp using '.' as separators, and issues a dns.resolve4() query for the resulting label under a hardcoded out-of-band domain oob.algamil7x.xyz. The destination domain, the prefix, and the Node built-in module names ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd', 'resolve4', '_load') are stored as hex byte arrays in lib/a9b3de.js and lib/f8a2cd.js and reassembled at runtime via String.fromCharCode, with the runtime imported through module.constructor._load rather than a normal require. The library exposes no documented functionality that would motivate hiding its DNS destination or Node built-in module names. The result is a DNS-tunnel exfiltration of installer identity (username, host, cwd) to a non-first-party domain that fires automatically on every install. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in lib/f8a2cd.js