The gator-client npm package (version 9.9.11) contains embedded malicious code that activates during installation and on every require call. It collects the operating system username, hostname, and the basename of the current working directory, then performs DNS resolution queries to a domain controlled by the attacker (oob.sl4x0.xyz). This DNS-based exfiltration is designed to bypass HTTP egress filtering. The code uses obfuscation techniques such as storing function and module names as decimal byte arrays decoded at runtime to evade naive string scanning. The package's stated purpose is a cover, with the actual code path leading only to the beacon functionality. The attacker infrastructure is confirmed by matching email and domain ownership. The compromise is severe, and any system with this package installed should be considered fully compromised.

Systems with gator-client version 9.9.11 installed are fully compromised. Sensitive host identifiers are leaked to an attacker-controlled domain, potentially enabling further targeted attacks. Because the package executes malicious code on install and runtime, attackers may have persistent access or control. All secrets and keys on the affected system should be considered exposed and rotated immediately. Removal of the package alone may not remove all malicious artifacts or backdoors.

No official patch or fix is currently available for this malicious package. Immediate removal of the gator-client package version 9.9.11 is recommended. All secrets, credentials, and keys stored on the affected system should be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, consider rebuilding the affected system from a known good state. Monitor for any signs of persistent backdoors or additional malicious software.