@nf-addons/am-global-header@9.9.10

Analysis

The package's install hook (node index.js) runs a hidden telemetry probe at install time. The probe reads the installing user's OS username, hostname, and current working directory, then encodes them into a DNS query of the form nfamh.<username>.<hostname>.<cwd>.<timestamp>.oob[.]algamil7x[.]xyz and resolves it, exfiltrating host identity metadata to the attacker-controlled domain oob[.]algamil7x[.]xyz. The behaviour is obfuscated with character-code arrays and a dynamic module loader, and the package README falsely states it makes no network requests. No credentials or tokens are collected; the payload is a host-metadata beacon.