quartz-core@99.1.9

Analysis

The preinstall hook (node index.js) runs a DNS-based host-identity beacon on install. It reads the installer's username, hostname, and current working directory, encodes them into subdomains, and sends a DNS query of the form selftest.<username>.<hostname>.<cwd>.<timestamp>.oob[.]algamil7x[.]xyz to the attacker-controlled domain oob[.]algamil7x[.]xyz. The host metadata is exfiltrated out-of-band over DNS, evading HTTP-based detection. The package has no repository and no declared purpose.