The 'qr-code-styling-temp' npm package includes malicious code that executes during its install lifecycle script and whenever it is required. It collects the username, hostname, and current working directory basename from the host system and encodes this information into a subdomain of 'oob.sl4x0.xyz'. It then performs a DNS resolve4 lookup to this subdomain, effectively leaking sensitive environment details to an attacker-controlled domain. The package uses obfuscation techniques such as hiding module names and the command-and-control domain in character code arrays and dynamically loading modules to evade static detection. The package name mimics a popular library to lure victims, and the author email domain matches the exfiltration domain, confirming attacker control. The package versions 9.9.10 and 9.9.11 are affected. According to the source, any system with this package installed should be considered fully compromised.

Systems with this package installed or running are at high risk of full compromise. Sensitive information such as usernames, hostnames, and working directory names are exfiltrated to an attacker-controlled domain. The compromise may allow attackers to gain persistent access and control over the affected system. Secrets and keys stored on the compromised system should be considered exposed and require immediate rotation from a secure environment. Removal of the package alone does not guarantee eradication of all malicious artifacts.

Remove the 'qr-code-styling-temp' package immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored or used on the compromised system from a different, trusted environment. Because the package may have allowed full system compromise, conduct a thorough incident response and forensic analysis to identify and remediate any additional persistence mechanisms or malware. No official patch or fix is available; the package itself is malicious and should be avoided entirely.