MAL-2026-12791 Malicious code in gs-uitk-object-utils (npm)

package.json declares scripts.install: node index.js, which requires ./lib/core. lib/core.js reads the OS username, hostname, and current working-directory basename, assembles them with a hardcoded goldman1 prefix into a subdomain of oob.sl4x0.xyz, and issues a dns.resolve4 lookup against that name, causing the installer's host identifiers to be transmitted as a DNS query to the attacker-controlled authoritative server. The destination domain, prefix, and API names (os, dns, userInfo, hostname, cwd, resolve4) are stored as char-code arrays in lib/b02e30.js and lib/6ad264.js and decoded at runtime via String.fromCharCode, concealing the exfiltration path. The same code also fires on require() of the package. The package presents itself as an object-utility library, which does not match the observed install-time DNS beaconing.