Malicious code in @shared-runtime/modules (npm)

__

Source: amazon-inspector (bc6095cf4766c948193c22d8c0e775010fc3ab47733a1020fb8fd5367d88e5e9)

@shared-runtime/modules@9.9.10 collects the installer's OS username (os.userInfo().username), hostname (os.hostname()) and current working-directory basename, then issues a dns.resolve4() query against a subdomain assembled as srmods.....oob.algamil7x.xyz, leaking those values via authoritative DNS logs at the attacker-controlled domain oob.algamil7x.xyz. The destination hostname, the OS/DNS API names, and the module names are stored as hex byte arrays in lib/a74d1f.js and lib/f63c0e.js and reconstructed at runtime via String.fromCharCode, with os and dns loaded through module.constructor._load to avoid literal require() strings. Execution is triggered both at install (package.json scripts.install="node index.js") and on require() (index.js top-level require('./lib/core.js')), with a swallowed try/catch so npm install still reports success. The README claims no hidden network calls in module scope while module scope performs exactly that.