Malicious code in @sarex-team/ui-kit (npm)

@sarex-team/ui-kit version 9.9.11 is a malicious npm package that executes a DNS-based out-of-band exfiltration beacon both on npm install (via the package.json scripts.install field running node index.js) and on runtime when the package is required (top-level require of lib/core.js). The malicious code collects sensitive host information including the OS username, hostname, and current working directory basename, then performs a DNS resolve4 lookup against a subdomain of oob.sl4x0.xyz constructed from these values, effectively leaking host identity data. The exfiltration code is obfuscated using hex char-code arrays and _0x-prefixed identifiers to evade static detection. The package masquerades as legitimate enterprise utilities with decoy modules and provides a non-functional GitHub repository URL. The author email domain matches the exfiltration domain, confirming the malicious nature of the package.

This malicious package leaks sensitive host environment information (OS username, hostname, and current working directory) to an attacker-controlled domain via DNS queries. This can lead to privacy violations, reconnaissance for further attacks, and potential compromise of development or build environments where the package is installed or used. There is no indication of further payloads or direct system compromise, but the data leakage itself poses a significant security risk.

No official patch or remediation is currently available. Users should immediately remove and avoid using @sarex-team/ui-kit version 9.9.11. Audit dependency trees for this package and any transitive dependencies. Replace it with trusted alternatives and verify package sources carefully. Monitor for any DNS queries to oob.sl4x0.xyz or related domains as indicators of compromise. Since this is a malicious package, the best mitigation is to avoid installation and usage altogether.