Malicious code in @sarex-team/sdk-js (npm)

The npm package @sarex-team/sdk-js contained malicious code designed to perform reconnaissance and exfiltrate system information. The package declared a scripts.install hook that executed node index.js, which required lib/core.js and triggered the malicious behavior.\n\nThe malicious code collected sensitive system information including the current user's username, hostname, and working directory. This data was combined with a package tag and timestamp, then exfiltrated via DNS resolution queries to subdomains of oob.sl4x0.xyz, an attacker-controlled out-of-band data collector. The DNS tunneling technique allowed data exfiltration without obvious network traffic.\n\nTo evade detection, the attacker obfuscated API names and domain references by storing them as hex byte arrays in lib/b02e30.js and lib/6ad264.js, reconstructing them at runtime using String.fromCharCode. The beacon executed automatically during npm install and on every subsequent require() of the package, requiring no user interaction.\n\nThe malicious package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.