MAL-2026-14428 Malicious code in consumerweb-serverutils (npm)

consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working directory, walks up the directory tree to read the enclosing project's package.json (name, author, version), hex-encodes the aggregated JSON, splits it into 60-character chunks, and exfiltrates it as DNS label queries to the attacker-controlled zone o.jgl.red (observed subdomain da5u87oh92rc72pp1dngqfc6hp8gwshm6.o.jgl.red). A fallback dns.lookup using the hostname is issued on error. Use of DNS as the transport bypasses HTTP egress controls and covers the payload on the wire, and the parent-package walk enables dependency-confusion targeting of the installer's private/internal package names.