The [email protected] npm package runs node index.js during its install lifecycle hook, which loads internal modules that reconstruct obfuscated code to perform a DNS resolve4 query. This query sends a subdomain composed of the installer's OS username, hostname, current working directory, and a timestamp with a static prefix to the external domain oob.sl4x0.xyz. This behavior leaks sensitive environment information via DNS to an out-of-band canary domain, violating the package's README statement that no network requests are made.

This malicious behavior results in the leakage of potentially sensitive environment information (username, hostname, working directory, and timestamp) from the system installing the package. Such information disclosure can aid attackers in profiling the target environment or correlating installations to specific users or hosts. There is no indication of further exploitation or code execution beyond this data exfiltration.

No official patch or remediation is currently documented. Users should avoid installing lakk-analytics version 9.9.11 and consider removing it if already installed. Monitor for updates from the package maintainer or npm registry for any official fixes or advisories. Since this is a malicious package behavior, consider using trusted package sources and scanning dependencies for malicious activity.