The @ceeferenderer/fe-renderer-sdk npm package runs malicious code at install time via an install script and at require time via its main module. It uses obfuscated helper modules to construct strings and dynamically load built-in Node.js modules to evade static analysis. The package assembles a unique subdomain containing the installer's OS username, hostname, current working directory basename, and a timestamp, then performs a DNS resolve4 lookup to exfiltrate this information to a domain controlled by attackers (oob.sl4x0.xyz). The combination of obfuscation, dynamic code execution, DNS-based data exfiltration, and silent error swallowing constitutes a credential reconnaissance beacon. Removal of the package does not guarantee system cleanup due to potential full system compromise.

Any system with this package installed or running should be considered fully compromised. The package exfiltrates sensitive environment information to an attacker-controlled domain, potentially enabling further attacks. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted system. Because the package executes code at install and runtime and may have granted attackers persistent access, removing the package alone may not restore system integrity.

Immediate removal of the @ceeferenderer/fe-renderer-sdk package is recommended. All credentials, secrets, and keys stored on the affected system should be rotated from a different, secure machine. Due to the high likelihood of full system compromise, a full system audit and potential rebuild from a known good backup are advised. No official patch or fix is available for this malicious package; remediation relies on removal and credential rotation.