rendezvous-js@9.9.11

Analysis

During npm install, the lifecycle hook runs node index.js which loads an obfuscated DNS beacon (lib/core.js, lib/6ad264.js, lib/b02e30.js). The beacon collects os.userInfo().username, os.hostname(), and process.cwd(), sanitizes each to 15 alphanumeric characters, joins them with a dot-separator prefix (lwrendezvous) and an attacker-controlled domain (oob[.]sl4x0[.]xyz), then sends the assembled subdomain as a DNS resolve4 look-up: lwrendezvous.{username}.{hostname}.{cwd}.{timestamp}.oob[.]sl4x0[.]xyz. This exfiltrates identifying host metadata from every install to the OOB domain sl4x0[.]xyz. The code uses char-code-array obfuscation (javascript-obfuscator pattern) to hide the imports of os, dns, and process modules. No token theft was observed; this is a standalone host-surveillance DNS beacon activated on package install.