@tesla-insurance/vinless-quote@9.9.10

Analysis

The install hook (node index.js) runs an obfuscated telemetry probe that exfiltrates host identity over DNS. It loads os/dns/process via module.constructor['_load'], reads the current username (os.userInfo().username), hostname (os.hostname()), and working-directory basename (process.cwd()), then issues a DNS resolve4 query to the subdomain tivq.<username>.<hostname>.<cwd>.<timestamp>.oob[.]algamil7x[.]xyz, encoding the host fingerprint into the DNS query name for collection at oob[.]algamil7x[.]xyz. The probe is bundled under runtime/support/telemetry/probe/ (f2a8c4.js, a3b9d5.js, impl.js) and is invoked automatically during npm install.