MAL-2026-12491 Malicious code in uploader-frontend (npm)

The package's scripts.install runs node index.js, which loads ./lib/core and, on npm install, collects the installer's OS username (via os.userInfo().username), hostname (os.hostname()), and current working directory basename, encodes them as a subdomain, and issues a dns.resolve4 lookup against the hardcoded attacker domain oob.sl4x0.xyz — a DNS out-of-band beacon that exfiltrates installer identity. The require targets (dns, os, process), the API names (userInfo, username, hostname, cwd, resolve4), and the destination domain are reconstructed at runtime from String.fromCharCode numeric arrays to hide the destination and the APIs used. Package name and README advertise uploader-frontend / enterprise utilities and validation, but the auto-executed code implements no such functionality — only the beacon. The author email [email protected] shares the domain of the exfil host, and homepage points at an unrelated project (github.com/slaxorg/nms-dashboard-js), indicating publisher-controlled attacker infrastructure.