@tvg-mar/promos-context@9.9.10

Analysis

The package's install hook (node index.js) executes a hidden telemetry probe that collects the installer's OS username, hostname, current working directory name, and a timestamp, then exfiltrates them by issuing a DNS resolve4 query to the attacker-controlled domain oob[.]algamil7x[.]xyz (query format: tvgctx.<username>.<hostname>.<cwd>.<timestamp>.oob[.]algamil7x[.]xyz). The probe strings are char-code-obfuscated and modules are loaded dynamically to evade detection. The package is otherwise a small promos-context library; the beacon runs on install regardless of whether the library is used.