@tink/tink-link-core@9.9.10

Analysis

The install hook (node index.js) runs a DNS exfiltration beacon. On install, the package reads the victim's OS username, hostname, and current working directory, then resolves a DNS query of the form tinkcore.<username>.<hostname>.<cwd>.<unix_timestamp>.oob[.]algamil7x[.]xyz via dns.resolve4, leaking host metadata to the attacker-controlled domain oob[.]algamil7x[.]xyz. The package is disguised as an open-banking SDK but contains no legitimate functionality tied to that claim.