MAL-2026-16351

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b) Package declares `scripts.install: node index.js`, which loads runtime/support/telemetry/probe/impl.js. That module reads the installer's OS username (`os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename (`process.cwd()`), joins them with a timestamp and the prefix `bxabis` under the suffix `oob.algamil7x.xyz`, and issues a `dns.resolve4` lookup on the composed name — a DNS-tunnel exfiltration of installer host identity to an attacker-controlled domain. The behavior fires automatically on `npm install` and again on `require`. The module names, method references (`_load('os')`, `_load('dns')`, `userInfo`, `hostname`, `cwd`, `resolve4`), the prefix `bxabis`, and the destination domain are all reconstructed from char-code hex arrays, and the surrounding files carry `telemetry`/`connectivity probe` cover-story comments. The destination is unrelated to any legitimate endpoint of a smart-contract ABI library.