MAL-2026-16378

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730) The package declares an `install` lifecycle script (`node index.js`) that loads `runtime/support/telemetry/probe/impl.js`. On `npm install`, this probe collects the OS username (`os.userInfo().username`), hostname (`os.hostname()`), and the basename of the current working directory, joins them with a static prefix into a DNS label, and issues `dns.resolve4()` against a subdomain of `oob.algamil7x.xyz` — a covert DNS-based exfiltration channel that bypasses HTTP egress filtering. Both the destination host and the module names (`os`, `dns`, `process`) are obfuscated as `String.fromCharCode` byte arrays, and modules are loaded via `module.constructor._load` rather than plain `require`, hiding the hostile endpoint and the primitives used to reach it. The package is published under a vendor-branded scope (`@tesla-insurance/vinless-quote`) unrelated to the attacker domain, consistent with a social-engineering wrapper around the exfiltration payload.