The connectedmerchantsserv package (npm ecosystem) version 9.9.11 includes a malicious install script that runs node index.js, which loads a module that gathers the installer's OS username, hostname, and current working directory basename. These values are encoded as subdomain labels prefixed with 'paypal2' and sent out-of-band via DNS resolve4 queries to the attacker's authoritative DNS server at oob.sl4x0.xyz. The code uses obfuscation techniques by reconstructing API names and the destination domain from character codes to avoid static analysis detection. The package masquerades as enterprise utilities but contains no legitimate functionality.

Sensitive environment information from the installer's machine is leaked to an attacker-controlled DNS server during package installation. This data leakage can aid attackers in profiling the victim environment and potentially facilitate further targeted attacks. There is no indication of direct code execution beyond the data exfiltration described.

No official patch or remediation is currently available for this malicious package version. Users should avoid installing connectedmerchantsserv version 9.9.11. Verify package integrity and source before installation, and consider using trusted package registries and tools that detect malicious packages. Monitor for updates from the package maintainer or npm security advisories for any remediation.