Malicious code in @sarex-team/translator (npm)

The @sarex-team/translator npm package version 9.9.11 includes an install lifecycle script that automatically executes 'node index.js' on installation. This script loads a module that gathers system information such as os.userInfo().username, os.hostname(), and the basename of process.cwd(). It concatenates these values with a timestamp to form subdomain labels and performs a DNS resolve4 lookup against the domain oob.sl4x0.xyz, which is controlled by the attacker. The code reconstructs module and accessor names at runtime from obfuscated hex-named files to conceal the exfiltration mechanism. The destination domain matches the package author's contact email domain, confirming the exfiltration endpoint is attacker-controlled.

This malicious package exfiltrates identifying information about the system and user installing the package to an attacker-controlled DNS server. This can lead to privacy breaches and potentially aid further targeted attacks. There is no indication of additional payloads or direct system compromise beyond information leakage. No known exploits in the wild have been reported.

Users should avoid installing version 9.9.11 of the @sarex-team/translator package. Since no patch or fixed version is provided, the best mitigation is to remove or replace this package with a trusted alternative. Review your dependency tree for this package and audit installed packages for suspicious behavior. Monitor for updates or advisories from the package maintainer or npm regarding remediation.