@tvg-mar/utils@9.9.10

Analysis

The package's install hook (node index.js) runs a hidden telemetry probe that exfiltrates host metadata over DNS. On install it collects the OS username, hostname, current working directory basename, and a Unix timestamp, concatenates them into a subdomain of oob[.]algamil7x[.]xyz (format: tvgut.<username>.<hostname>.<cwd>.<timestamp>.oob[.]algamil7x[.]xyz), and triggers a DNS resolution of that subdomain, transmitting the data to the attacker-controlled domain. The probe is obfuscated with charcode-array decoding and dynamic module loading to hide its behaviour. The package otherwise presents as a benign shared-utilities library.