Malicious code in @sarex-team/viewer (npm)

The @sarex-team/viewer npm package version 9.9.11 includes a DNS-based beacon that leaks the installer's OS username, hostname, and current working directory basename by encoding these values as subdomains under the attacker-controlled domain oob.sl4x0.xyz. The package's lib/core.js collects this information using os.userInfo().username, os.hostname(), and process.cwd(), then performs a dns.resolve4() lookup to exfiltrate the data. The domain and module names are obfuscated by reconstructing them from numeric char-code arrays in lib/b02e30.js and lib/6ad264.js to evade detection. The malicious code executes automatically during npm install via the scripts.install entry 'node index.js' and again on every require() of the package, with errors silently caught to avoid raising suspicion.

Sensitive environment information including the OS username, hostname, and current working directory basename is leaked to an attacker-controlled domain via DNS queries. This can aid attackers in reconnaissance and further targeted attacks. The exfiltration occurs without user interaction and is triggered during installation and runtime, potentially affecting all users who install or require this specific package version.

No official patch or remediation is currently documented. Users should avoid installing or using @sarex-team/viewer version 9.9.11. Remove this package from any environments where it is installed. Monitor for any unauthorized DNS queries to suspicious domains such as oob.sl4x0.xyz. Check the vendor or package repository for updates or official advisories regarding this malicious package.