🛡️ MAL-2026-12506 — location

Malicious code in @latlongid/location (npm)

Source: amazon-inspector

@latlongid/[email protected] declares postinstall: node index.js in package.json, so index.js runs automatically on every npm install. That script hex-encodes the installer's os.hostname() and embeds it as a subdomain of dns.gl0b.xyz, then invokes dns.lookup on the constructed name (e.g. 2d5bccee-...-h<hex(hostname)>.<rand>.dns.gl0b.xyz). The DNS query name itself carries the host identifier off the machine, so exfiltration succeeds regardless of resolution result. The scoped name and generic 'internal utility' metadata are consistent with a dependency-confusion reconnaissance beacon designed to enumerate reachable internal build environments.