MAL-2026-17154

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5f4f7297a2ae76eee65506183462a7138df6115ee2bfad9c84878b7f3c7998c8) The package's `install` lifecycle script runs `node index.js`, which loads `runtime/support/telemetry/probe/impl.js`. That module reads `os.userInfo().username`, `os.hostname()`, and `process.cwd()`, concatenates them with a fixed prefix `nfamh` and a timestamp into a single DNS label, and issues a `dns.resolve4` query against the hardcoded domain `oob.algamil7x.xyz`, exfiltrating installer identity over DNS on `npm install`. The same code path also fires on every `require()` of the package via the declared `main`. Destination domain, the loader targets `os`/`dns`, and the identifiers `userInfo`/`hostname`/`cwd`/`resolve4` are stored as charcode/hex arrays and reconstructed at runtime via `String.fromCharCode`, and the `os` and `dns` modules are pulled in through `module.constructor._load` rather than `require`, concealing the destination and API surface from static inspection. Comments frame the behavior as `registry connectivity diagnostics`, contradicting the actual dataflow.