The @sarex-team/sdk-js package at version 9.9.11 declares an install script that runs node index.js, which loads lib/core.js. This script gathers system information (os.userInfo().username, os.hostname(), process.cwd()) and combines it with a package tag and timestamp. It then performs DNS resolution requests to a subdomain of oob.sl4x0.xyz, an attacker-controlled domain, effectively creating a DNS-tunneled beacon. The domain and Node.js API names are stored as hex-encoded byte arrays in separate library files and decoded at runtime to evade detection. The beacon triggers automatically on npm install and on every require() call of the package, requiring no user interaction.

This malicious package leaks sensitive system information to an attacker-controlled domain without user consent. The data exposed includes username, hostname, and current working directory, which can aid attackers in profiling the victim environment for further attacks or reconnaissance. The automatic execution on install and require() increases the risk of widespread data leakage in environments where this package is used.

No official patch or remediation guidance is provided in the available data. Users should immediately remove and avoid using version 9.9.11 of @sarex-team/sdk-js. Verify dependencies and lockfiles to ensure this malicious version is not included. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Consider using tools to detect malicious packages and audit dependencies regularly.