GCVE-110-OSM-2026-12428

The package declares `scripts.install` = `node index.js`, so `npm install @baanx/solana-lib` automatically executes `index.js`, which loads `lib/core.js`. That module reads the installer's username (`os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename, concatenates them with a timestamp and the static prefix `bxsol`, and issues a `dns.resolve4()` lookup against `<prefix>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz` — a DNS-based out-of-band beacon that leaks installer identity to a hardcoded non-first-party domain. Helper modules `lib/e5f0a2.js` and `lib/f6a1b3.js` reconstruct the strings `os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`, the prefix `bxsol`, and the destination host `oob.algamil7x.xyz` from `String.fromCharCode` byte arrays, and load Node builtins indirectly via `module.constructor._load('os')` / `_load('dns')` to conceal the behavior. The package is presented as a Solana library; the char-code-obfuscated destination and the install-time host-recon beacon are inconsistent with any legitimate Solana functionality. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in lib/e5f0a2.js ADDITIONAL FINDINGS - Very New NPM Publisher Account