discovered
Near-identical sibling of uploader-frontend, same untargeted install-beacon publish in the sl4x0 Enterprise Dependency Confusion campaign; NOT a confirmed dependency-confusion target (name matches no identified enterprise namespace). Same NEW publisher dialoguepoc@sl4x0.xyz, same reused author 'Enterprise Tools Team <research@sl4x0.xyz>', same fabricated repo github.com/slaxorg/nms-dashboard-js, created 2026-07-20 with only 2 versions (9.9.0, 9.9.11). Mechanism byte-identical to uploader-frontend (install-hook -> lib/core.js recon -> dns.resolve4() exfil to oob.sl4x0.xyz with the setTimeout unref refinement), differing only in the per-package config lib/b02e30.js, which decodes to the per-package DNS tag 'uploadfele'. No file hashes were provided for this sibling specifically; its config file differs so its hashes necessarily differ from uploader-frontend's, and the tag value is confirmed via source only, not hash.