reseller-app@9.9.11

Analysis

An install hook (node index.js) silently loads an obfuscated payload that collects the system username, hostname, and current working directory name via os.userInfo(), os.hostname(), and process.cwd(). This data is exfiltrated via a DNS resolution query to the C2 domain oob[.]sl4x0[.]xyz in the format boltres.{user}.{host}.{cwd}.{timestamp}.oob[.]sl4x0[.]xyz. The package presents itself as enterprise utility code but the core payload is obfuscated using the javascript-obfuscator dictionary-array pattern and has no legitimate function.