MAL-2026-16290

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@insiderintelligence/googleadmanager/MAL-2026-16290.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16290
Published
2026-09-18T20:25:35Z
Modified
2026-09-18T20:45:06Z
Summary
Malicious code in @insiderintelligence/googleadmanager (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5)

The package's install lifecycle script runs node index.js, which loads lib/core.js. On install, that module collects os.userInfo().username, os.hostname(), and the basename of the current working directory, then issues a dns.resolve4 for a subdomain composed of those values under the hardcoded external domain oob.algamil7x.xyz. Module loads and the destination hostname are hex-array obfuscated: lib/g7h8i9.js uses module.constructor._load with hex-decoded strings to require os, dns, and process, and lib/h8i9j0.js stores the destination as hex arrays that decode to oob.algamil7x.xyz. The package name typosquats a legitimate ad-tech scope, and no functionality matching that stated purpose is present — the install-time DNS beacon is the package's only observable behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020190",
            "import_time": "2026-09-18T20:38:13.983794137Z",
            "modified_time": "2026-09-18T20:25:35Z",
            "sha256": "a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5",
            "source": "amazon-inspector",
            "versions": [
                "9.9.10"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @insiderintelligence/googleadmanager

Package

Name
@insiderintelligence/googleadmanager
View open source insights on deps.dev
Purl
pkg:npm/%40insiderintelligence/googleadmanager

Affected ranges

Affected versions

9.*
9.9.10

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/core.js",
            "sha256": "eb289c4c56f48f3f0e2baa1ea8ed7f13c9ea9c5d317f79d5d934372ba8881dfc",
            "tlsh": "b1f07d69b393c08fa7e092d0360a43d18859c2c0d7cf4095fb7c0a87800e7d1ca85965"
        },
        {
            "path": "lib/h8i9j0.js",
            "sha256": "7310b9e76e1621bcbfa779e6b138c08ebd35a14ab95237e31caf6eb994ae80c7",
            "tlsh": "57e0201b21dfe14fa69c5eb72f17c4dbc8860900a21c8ad9fe1d06c7106a057c0c0771"
        }
    ],
    "package_integrity": [
        {
            "filename": "googleadmanager-9.9.10.tgz",
            "hashes": {
                "sha1": "3adc35820941749c0af946f125d98662d589d0c2",
                "sha512_sri": "sha512-UoU5RouL2hqrYmFD5aaiS09TOrpXviXqDc1GnuOI/66g3BMlw5BX+HQ0BsrYbeQuR/DLaGitDLJOgmw/qBVfbg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@insiderintelligence/googleadmanager/MAL-2026-16290.json"