@sapappgyver/appgyver-descriptors@9.9.11

Analysis

@sapappgyver/appgyver-descriptors@9.9.11 is a combosquat package impersonating SAP AppGyver. On install, the package runs an obfuscated beacon in lib/core.js that collects the installer's username, hostname, current working directory, and current timestamp, then exfiltrates this host metadata via a DNS query to oob[.]sl4x0[.]xyz. The DNS query format is: {prefix}.{username}.{hostname}.{cwd}.{timestamp}.oob[.]sl4x0[.]xyz. The package ships legitimate-looking utility code in src/ as cover, while the obfuscated payload resides in lib/6ad264.js, lib/b02e30.js, and lib/core.js. The publisher email ([account]) shares the C2 domain. No credential or token theft was observed — the payload is a host-metadata beacon only.