The [email protected] npm package registers index.js as both its install script and main entry point. Upon installation or import, index.js loads lib/core.js, which gathers system identifiers (os.userInfo().username, os.hostname(), process.cwd()) and concatenates them with a 'paypal' prefix, a timestamp, and the domain oob.sl4x0.xyz. It then performs a DNS resolve4 query to exfiltrate this information to an attacker-controlled domain. The code obfuscates API names and the exfiltration endpoint by reconstructing them at runtime from character code arrays in auxiliary scripts, evading static analysis. The package's name suggests a compliance-related utility, but its sole effect is this DNS beaconing behavior.

This malicious package exfiltrates sensitive system information during installation or import, potentially compromising user privacy and security. The data sent includes username, hostname, and current working directory, which could aid attackers in profiling or targeting affected systems. There is no indication of further payload or exploitation beyond this data leakage.

No official patch or remediation is currently available for [email protected]. Users should avoid installing or using this specific version. Since this is a malicious package, removing it from projects and replacing it with trusted alternatives is recommended. Monitor dependency sources carefully to prevent inclusion of similarly disguised malicious packages.