oc-navbar-module-client@9.9.10

Analysis

oc-navbar-module-client@9.9.10 is a malicious typosquat/proxy package using a high version number (9.9.10) to appear mature. Its install hook (node index.js) loads an obfuscated three-stage payload: (1) a config module holding the exfil domain oob[.]sl4x0[.]xyz; (2) a module using module.constructor._load to import os/dns while bypassing require hooks; and (3) a payload that collects OS username, hostname, and cwd, then exfiltrates them by crafting a DNS resolve4 query of the form ocnavbar.<username>.<hostname>.<cwd>.<timestamp>.oob[.]sl4x0[.]xyz.