@tvg-mar/tvg-promos-atomic-ui@9.9.10

Analysis

The package's install hook (node index.js) runs a runtime bootstrap that collects the host's username, hostname, current working directory name, and a timestamp, encodes them into a DNS query string, and sends them to the attacker-controlled domain tvguioob[.]algamil7x[.]xyz via a dns.resolve4 lookup. The domain is charcode-obfuscated inside runtime/support/telemetry/probe/c3f7a9.js. The package is presented as a UI component library but the install-time beacon exfiltrates host metadata to the remote domain.