MAL-2026-14205 Malicious code in @sarex-team/translator (npm)

The package's install lifecycle script (scripts.install="node index.js") automatically executes on npm install and loads lib/core.js. That module reads os.userInfo().username, os.hostname(), and the basename of process.cwd(), concatenates them with a timestamp as subdomain labels, and issues a dns.resolve4 lookup against oob.sl4x0.xyz — encoding the installer's identity into a DNS query that reaches the attacker's authoritative nameserver. The destination domain, the module names ('os', 'dns', 'process'), and the accessor names ('userInfo', 'hostname', 'cwd') are reconstructed at runtime from char-code arrays in hex-named files (lib/b02e30.js, lib/6ad264.js), concealing the exfiltration path from casual review. The exfil domain sl4x0.xyz matches the package author's contact email ([email protected]), confirming the destination is author-controlled.