The gs-uitk-testing-utils npm package version 9.9.11 declares an install lifecycle script that runs node index.js, which loads a module that gathers host-identifying information including the OS username, hostname, and current working directory basename. This data is concatenated with a campaign marker 'goldman2' and a timestamp, then exfiltrated by issuing DNS resolve4 requests to subdomains of oob.sl4x0.xyz. The exfiltration code and domain strings are obfuscated using character code arrays to evade static detection. The package name mimics an internal UI toolkit namespace, and the author email domain matches the exfiltration domain, indicating a targeted dependency confusion reconnaissance attempt. The malicious activity triggers automatically on npm install and on require of the package.

This malicious package leaks sensitive host environment information to an attacker-controlled domain during installation and usage, potentially enabling targeted reconnaissance and further attacks against the affected organization. The data exfiltration occurs without user consent and could compromise operational security by revealing internal hostnames, usernames, and directory structures.

No official patch or remediation is currently documented. Users should avoid installing or using gs-uitk-testing-utils version 9.9.11. Verify package authenticity before installation, especially for packages mimicking internal namespaces. Monitor for suspicious DNS queries to unknown domains such as oob.sl4x0.xyz. Check vendor advisories or trusted sources for updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.