@latlongid/location@1.0.1

Analysis

The package runs a DNS-based host-identity beacon on install. The postinstall hook executes index.js, which reads the machine's hostname via os.hostname(), hex-encodes it, and embeds it in a DNS lookup to the domain dns[.]gl0b[.]xyz. The query pattern is: {beacon-uuid}.h{hex-hostname}.{random-nonce}.dns[.]gl0b[.]xyz. The beacon UUID is 2d5bccee-3cfd-4d29-9131-2ecddf01d462. The hostname is exfiltrated to the DNS resolver at dns[.]gl0b[.]xyz on every install.