The uploader-frontend-legacy npm package version 9.9.11 includes a malicious install script that runs node index.js, which loads core modules and issues a DNS resolve4 query to a subdomain of oob.sl4x0.xyz. The subdomain is dynamically constructed from the installer's username, hostname, current working directory, a package tag, and a timestamp, effectively beaconing identifying data to an attacker-controlled out-of-band listener. The code uses obfuscation techniques by assembling module and API names from character codes across multiple JavaScript files to hide this behavior from casual review. This results in an outbound DNS beacon during npm install, potentially leaking sensitive environment information to the attacker.

The impact is the unauthorized exfiltration of environment-specific information (username, hostname, working directory) from systems installing this package. This can aid attackers in profiling victims or further targeted attacks. There is no indication of direct code execution beyond the install script or additional payloads. No known active exploitation has been reported.

No official patch or remediation guidance is provided. Users should avoid installing version 9.9.11 of uploader-frontend-legacy. Investigate alternative trusted package versions or sources. Monitor for suspicious DNS queries to domains like oob.sl4x0.xyz during package installation. Since no fix is confirmed, consider removing or replacing the affected package version.