The gs-uitk-testing-utils package at version 9.9.11 declares an npm install lifecycle script that runs node index.js, which loads a module that collects the installer's OS username, hostname, and current working directory basename. This data is concatenated with a hardcoded campaign marker 'goldman2' and a timestamp, then exfiltrated via DNS resolution queries to a subdomain of oob.sl4x0.xyz. The code reconstructs key strings at runtime from character code arrays to evade static analysis. The package name mimics an internal UI toolkit namespace, and the author email domain matches the exfiltration domain, indicating targeted dependency confusion reconnaissance. The exfiltration triggers automatically on npm install and on require of the package.

This malicious package leaks sensitive host-identifying information to an attacker-controlled domain during installation and usage, potentially enabling targeted reconnaissance and further attacks against the affected organization. The exfiltration of OS username, hostname, and working directory information compromises host privacy and security posture. There is no indication of direct code execution beyond the exfiltration, but the presence of such a backdoor in a dependency can facilitate broader compromise.

No official patch or remediation is currently documented. Users should avoid installing or requiring gs-uitk-testing-utils version 9.9.11. Audit dependencies for typosquatting or dependency confusion risks. Monitor for suspicious DNS queries to domains like oob.sl4x0.xyz. Remove the affected package from projects and replace it with trusted versions or alternatives. Check vendor advisories or npm security advisories for updates.