GCVE-110-OSM-2026-12527

The package declares scripts.install: node index.js, so npm install auto-executes index.js which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo().username, os.hostname(), and the current working directory's leaf name, joins them with a fixed prefix (iiclib) and a timestamp into a subdomain label, and issues a dns.resolve4() query against oob.algamil7x.xyz — exfiltrating installer identity via a DNS side-channel that bypasses HTTP egress controls. The destination host, the module names ('os','dns','process'), and the resolved API names ('userInfo','hostname','cwd','resolve4','_load') are hidden behind String.fromCharCode arrays in sibling helpers a8e4c9.js and f7d3b8.js, and the module is loaded via module.constructor._load through encoded literals to disguise the primitive as a 'connectivity probe'. The same path also runs on require() because index.js is the package main. The behavior has no connection to the package's stated component-library purpose. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in runtime/support/telemetry/probe/f7d3b8.js ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages