@insiderintelligence/componentlibrary@9.9.10

Analysis

The install hook runs node index.js, which bootstraps a runtime that executes a DNS-exfiltration beacon. The beacon collects the OS username, hostname, current working directory basename, and a Unix timestamp, then encodes them into a DNS query of the form iiclib.<username>.<hostname>.<cwd>.<timestamp>.oob[.]algamil7x[.]xyz and resolves it, leaking host identity to the attacker-controlled domain oob[.]algamil7x[.]xyz. The payload is obfuscated with byte-array string decoding and loads modules via module.constructor._load to bypass standard require auditing.