uploader-frontend

Untargeted install-time DNS-beacon npm package in the sl4x0 Enterprise Dependency Confusion campaign. Unlike the campaign's named-target waves (e.g. Goldman Sachs gs-uitk-*), the name 'uploader-frontend' matches no identified enterprise internal namespace, so this is a generic/untargeted recon-beacon publish and NOT a confirmed dependency-confusion target. Published by the NEW npm account [email protected]; author identity 'Enterprise Tools Team <[email protected]>' reused (now the third confirmed cluster carrying that string, after Anduril/PyPI and Goldman Sachs/npm). Fabricated repo github.com/slaxorg/nms-dashboard-js reused verbatim from the Goldman wave. Created 2026-07-20; only 2 versions ever published (9.9.0, 9.9.11), last modified 2026-07-23T12:16Z (still live at analysis time). Mechanism is a byte-for-byte match to the gs-uitk / oc-aa-module-client family: package.json scripts.install 'node index.js'; index.js does require('./lib/core') inside try/catch then exports { ..., version: '9.9.11' }; hex-obfuscated lib/core.js harvests os.userInfo().username, os.hostname(), and the basename of process.cwd(), sanitizes each via a clean() helper (strip non-alphanumeric, truncate 15 chars), then calls dns.resolve4() on <tag>.<user>.<host>.<cwd>.<unix-ts>.oob.sl4x0.xyz. NEW refinement not seen in earlier oc-aa-module-client/gs-uitk samples: setTimeout(()=>{}, 500).unref() immediately after the DNS call, letting the beacon attempt to complete without holding the Node process open. lib/6ad264.js is the same utility wrapper ({ os, dns, proc: global.process, clean }); lib/b02e30.js hex-decodes to oob.sl4x0.xyz plus per-package DNS tag 'uploadfe'. Decoy src/{async,crypto,errors,formatting,network,transformation,validation}.js are plausible unobfuscated utility code serving no functional purpose (campaign decoy-padding pattern).