The lakk-analytics npm package version 9.9.11 runs code during its install lifecycle hook that loads internal modules to build a subdomain string containing the installer's OS username, hostname, current working directory, and a timestamp prefixed with 'asnbank'. It then performs a DNS resolve4 query to an out-of-band domain (oob.sl4x0.xyz), leaking sensitive environment details. The code obfuscates the destination host and API calls using hex code-point arrays reconstructed at runtime. Despite the README stating 'No network requests', the package performs this DNS beaconing on every install. The package is considered fully compromising to any system on which it is installed.

Installation of [email protected] results in leakage of sensitive environment information (username, hostname, working directory) via DNS to an attacker-controlled domain. The package is considered fully compromising, meaning an attacker may have gained control over the host system. All secrets and keys on the compromised system should be considered exposed and rotated immediately. Removal of the package does not guarantee removal of all malicious artifacts.

No official patch or fix is indicated. The package should be removed immediately from all affected systems. All secrets and keys stored on compromised systems must be rotated from a different, trusted machine. Due to the full compromise risk, affected systems should be thoroughly investigated and potentially rebuilt. Monitor for any unauthorized access or persistence mechanisms.