MAL-2026-13451

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601) nms-dashboard-js@9.9.11 declares an npm install lifecycle hook (`scripts.install: "node index.js"`) that unconditionally requires `./lib/core` inside a swallow-all try/catch. The loaded code reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`, concatenates them with a timestamp into a subdomain of `oob.sl4x0.xyz`, and issues a `dns.resolve4` lookup, exfiltrating installer host identifiers via DNS out-of-band. The destination domain and the API/property names (`os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`, `oob.sl4x0.xyz`) are reconstructed at runtime from hex char-code arrays in `lib/b02e30.js` and `lib/6ad264.js` to conceal the sink. The beacon also fires on any `require()` of the package, not only on install. The advertised purpose ("enterprise utilities") does not require any such network activity.