MAL-2026-14204 Malicious code in @sarex-team/sdk-js (npm)

Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo().username, os.hostname(), and process.cwd(), joins them with a package tag and timestamp, and issues dns.resolve4() against a subdomain of oob.sl4x0.xyz — a DNS-tunneled beacon to an attacker-controlled out-of-band collector. The destination host oob.sl4x0.xyz and the Node API names (os, dns, userInfo, hostname, cwd, resolve4) are stored as hex byte arrays in lib/b02e30.js and lib/6ad264.js and reconstructed at runtime via String.fromCharCode to disguise the recon path. The beacon fires automatically on npm install and again on every require() of the package, with no user interaction required.