The rendezvous-js npm package version 9.9.11 executes malicious code on install and require that collects sensitive host information (username, hostname, current working directory) and exfiltrates it via DNS A-record lookups to a domain controlled by the attacker (oob.sl4x0.xyz). The exfiltration uses encoded subdomains to bypass HTTP egress filtering. The malicious code is obfuscated by storing critical strings as decimal char-code arrays decoded at runtime. The README misrepresents the package's behavior by claiming no network or file system access. The author email and domain names suggest a typosquatting or dependency confusion attack vector. The package compromises host security and may lead to full system compromise.

Any system with rendezvous-js version 9.9.11 installed or running is considered fully compromised. The malicious code leaks sensitive host identity information to an attacker-controlled DNS server, potentially enabling further attacks. The compromise may extend beyond the package itself, as attackers could have established persistent access. All secrets and keys stored on the affected system should be rotated immediately from a separate, trusted device. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

No official patch or remediation is currently documented. Users should immediately remove the rendezvous-js package version 9.9.11 from all systems. Assume full compromise of affected hosts and rotate all credentials and secrets accessed from those systems using a secure, uncompromised environment. Monitor for suspicious DNS queries related to the domain oob.sl4x0.xyz. Review supply chain dependencies to avoid typosquatting or dependency confusion attacks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.