qr-code-styling-temp

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (004a5cc51cc0e38448c56189fb4437ad113eec163f7ae1a7692b88d6aed71182)
The package's `install` lifecycle script (`node index.js`) and its main entry both load `lib/core.js`, which reads `os.userInfo().username`, `os.hostname()`, and the current working directory basename and encodes them into a subdomain of `oob.sl4x0.xyz`, then triggers a `dns.resolve4` lookup of `samsung.<user>.<host>.<cwd>.<ts>.oob.sl4x0.xyz`. This is an out-of-band DNS exfiltration beacon that fires on every `npm install` and on every `require()` of the package, leaking installer identity to an attacker-controlled domain. Module names (`os`, `dns`, `process`, `userInfo`, `hostname`, `resolve4`) and the C2 domain are hidden as `String.fromCharCode` charcode arrays in lib/b02e30.js and lib/6ad264.js, with `os` and `dns` loaded via `module.constructor._load(...)` to evade static `require` scanners. The package name impersonates the popular `qr-code-styling` library but ships an unrelated API surface, and the author email `research@sl4x0.xyz` shares the same domain as the exfiltration host — confirming the typosquat lure and attacker-controlled infrastructure.

Compromised versions (2)

• 9.9.10
• 9.9.11

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.