@consts/links@9.9.9

Analysis

The package's install hook (node index.js) runs a hidden beacon in lib/core.js. On install it reads the victim's OS username, hostname, and current working directory, then encodes them into a DNS query of the form links.<username>.<hostname>.<cwd>.<timestamp>.oob[.]algamil7x[.]xyz and performs a DNS lookup against that domain, exfiltrating host identity to the attacker-controlled domain oob[.]algamil7x[.]xyz. The runtime modules (os, dns, process) are loaded through module.constructor._load to bypass require hooks, and the domain is stored as byte arrays in lib/b02e30.js to hide it from string scans.