@user-services/web-components@9.9.10

Analysis

The install hook (node index.js) runs an obfuscated telemetry probe that exfiltrates host identity over DNS. It loads os/dns/process via module.constructor['_load'], reads the current username (os.userInfo().username), hostname (os.hostname()), and working-directory basename (process.cwd()), then issues a DNS resolve4 query to the subdomain uswc.<username>.<hostname>.<cwd>.<timestamp>.oob[.]algamil7x[.]xyz, encoding the host fingerprint into the DNS query name for collection at oob[.]algamil7x[.]xyz. The probe is bundled under runtime/support/telemetry/probe/ (b8d6e3.js, c9e7f4.js, impl.js) and is invoked automatically during npm install. The package's README falsely claims no network requests beyond registry probes.