🛡️ MAL-2026-4655 — qr-code-styling-temp

Malicious code in qr-code-styling-temp (npm)

Source: amazon-inspector

The package's install lifecycle script (node index.js) and its main entry both load lib/core.js, which reads os.userInfo().username, os.hostname(), and the current working directory basename and encodes them into a subdomain of oob.sl4x0.xyz, then triggers a dns.resolve4 lookup of samsung.<user>.<host>.<cwd>.<ts>.oob.sl4x0.xyz. This is an out-of-band DNS exfiltration beacon that fires on every npm install and on every require() of the package, leaking installer identity to an attacker-controlled domain. Module names (os, dns, process, userInfo, hostname, resolve4) and the C2 domain are hidden as String.fromCharCode charcode arrays in lib/b02e30.js and lib/6ad264.js, with os and dns loaded via module.constructor._load(...) to evade static require scanners. The package name impersonates the popular qr-code-styling library but ships an unrelated API surface, and the author email [email protected] shares the same domain as the exfiltration host — confirming the typosquat lure and attacker-controlled infrastructure.