MAL-2026-12792 Malicious code in gs-uitk-testing-utils (npm)

[email protected] declares an npm install lifecycle script (scripts.install='node index.js') that loads lib/core.js. That module collects the installer's OS username (os.userInfo().username), hostname (os.hostname()), and the basename of the current working directory (process.cwd()), joins them with a hardcoded campaign marker 'goldman2' and a timestamp, and issues dns.resolve4() against a subdomain of oob.sl4x0.xyz, leaking host-identifying data over DNS. The destination domain, the target module names ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd'), and the marker are reconstructed at runtime from char-code arrays in lib/b02e30.js and lib/6ad264.js to hide them from static inspection. The package name mimics an internal 'gs-uitk-*' UI-toolkit namespace and pairs with the marker 'goldman2' and an author email at the same sl4x0.xyz domain used for exfiltration, consistent with dependency-confusion reconnaissance against a specific organization. The exfiltration fires automatically on npm install and on require of the package.