@shared-web/assets@9.9.10

Analysis

The install hook (node index.js) runs an obfuscated beacon. It reads the OS username, hostname, and current working directory basename, then exfiltrates them via a DNS resolve4 query to the attacker-controlled domain oob[.]algamil7x[.]xyz, encoded as <prefix>.<username>.<hostname>.<cwd>.<timestamp>.oob[.]algamil7x[.]xyz. The package otherwise presents as a legitimate asset/util library.