Malicious code in @sarex-team/ui-kit (npm)

@sarex-team/ui-kit is a malicious npm package that executes exfiltration code both at install time (via package.json scripts.install) and at runtime (via top-level require in lib/core.js). The malicious code collects sensitive host information including the installer's OS username, hostname, and current working directory basename, then performs DNS lookups against subdomains of oob.sl4x0.xyz constructed from these values to leak host identity through DNS queries.\n\nThe package employed obfuscation techniques to evade static analysis, reconstructing sensitive API names and the destination domain at runtime from hex character-code arrays using obfuscator.io-style identifiers. The package falsely presented itself as "Enterprise-grade utilities" with decoy modules for validation, formatting, networking, cryptography, and async operations.\n\nThe package's metadata contained indicators of malicious intent: the homepage and repository URL (github.com/slaxorg/@sarex-team/ui-kit) was malformed and did not resolve to a real repository, and the author email (research@sl4x0.xyz) matched the exfiltration domain, suggesting coordinated malicious activity.\n\nThe incident was identified and reported through the OpenSSF malicious packages repository, with the package now flagged in security advisories.", <parameter name="remediation">["Immediately uninstall @sarex-team/ui-kit from all systems", "Audit npm install logs to identify when the package was installed and on which systems", "Assume compromise of any system that installed this package; rotate credentials and review for unauthorized access", "Check for DNS queries to oob.sl4x0.xyz or related subdomains in network logs", "Review npm audit and lock files to ensure no other malicious packages are present", "Use npm security tools to scan for similar obfuscated malicious packages", "Report any systems that installed this package to your security team for forensic analysis"]