@latlongid/[email protected] declares a postinstall script in its package.json that runs index.js automatically on every npm install. The script hex-encodes the installer's os.hostname() and constructs a DNS query name embedding this encoded hostname as a subdomain of dns.gl0b.xyz. It then performs a dns.lookup on this constructed name, leaking the host identifier via the DNS query regardless of resolution success. This technique aligns with a dependency-confusion reconnaissance beacon designed to enumerate internal build environments accessible from the compromised machine.

The malicious code exfiltrates the hostname of the machine installing the package by embedding it in DNS queries to an attacker-controlled domain. This can reveal internal host identifiers and potentially expose internal network topology or build environments. While no direct code execution beyond the postinstall script is described, the information leakage can facilitate further targeted attacks such as dependency confusion or supply chain compromise.

No official patch or remediation is currently documented for this package version. Users should avoid installing @latlongid/[email protected] and remove it from their dependency trees if present. Consider auditing dependencies for malicious postinstall scripts and restrict installation of untrusted or unknown npm packages. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.