This malicious npm package '@insiderintelligence/googleadmanager' (version 9.9.10) executes code during its install lifecycle script that loads modules to gather system user information and hostname. It constructs a subdomain from this data and performs a DNS resolve4 query to a hardcoded external domain 'oob.algamil7x.xyz'. The code uses hex-array obfuscation to hide the module loading and the destination hostname. The package name mimics a legitimate ad-tech scope but contains no legitimate functionality, indicating a typosquatting attack designed to exfiltrate system information via DNS beaconing.

The package leaks system-specific information (username, hostname, current directory) to an external domain during installation, potentially compromising user privacy and system confidentiality. There is no indication of further malicious payloads or active exploitation beyond this data exfiltration behavior.

No official patch or remediation is documented. Users should avoid installing this package version (9.9.10) and verify package authenticity before installation. Remove any installations of this package and monitor for suspicious DNS queries to 'oob.algamil7x.xyz'. Since this is a typosquatting package, ensure correct package names are used from trusted sources.