MAL-2026-16291

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@shared-runtime/modules/MAL-2026-16291.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16291
Published
2026-09-18T20:25:02Z
Modified
2026-09-18T20:45:06Z
Summary
Malicious code in @shared-runtime/modules (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bc6095cf4766c948193c22d8c0e775010fc3ab47733a1020fb8fd5367d88e5e9)

@shared-runtime/modules@9.9.10 collects the installer's OS username (os.userInfo().username), hostname (os.hostname()) and current working-directory basename, then issues a dns.resolve4() query against a subdomain assembled as srmods.....oob.algamil7x.xyz, leaking those values via authoritative DNS logs at the attacker-controlled domain oob.algamil7x.xyz. The destination hostname, the OS/DNS API names, and the module names are stored as hex byte arrays in lib/a74d1f.js and lib/f63c0e.js and reconstructed at runtime via String.fromCharCode, with os and dns loaded through module.constructor._load to avoid literal require() strings. Execution is triggered both at install (package.json scripts.install="node index.js") and on require() (index.js top-level require('./lib/core.js')), with a swallowed try/catch so npm install still reports success. The README claims no hidden network calls in module scope while module scope performs exactly that.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020187",
            "import_time": "2026-09-18T20:38:13.751622937Z",
            "modified_time": "2026-09-18T20:25:02Z",
            "sha256": "bc6095cf4766c948193c22d8c0e775010fc3ab47733a1020fb8fd5367d88e5e9",
            "source": "amazon-inspector",
            "versions": [
                "9.9.10"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @shared-runtime/modules

Package

Name
@shared-runtime/modules
View open source insights on deps.dev
Purl
pkg:npm/%40shared-runtime/modules

Affected ranges

Affected versions

9.*
9.9.10

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/core.js",
            "sha256": "4070258a961f709343b8e24e65b570daee851b33aa3b48dd5c38ebc58bbcbf19",
            "tlsh": "57f02d69b393c48fa7e096d0361a53d18859c3c0e7cf4195fb7c4a87904e7d1cb85959"
        },
        {
            "path": "lib/f63c0e.js",
            "sha256": "f7942b52b33a05f44ce43c1cc581fa1140cbbef03acdba961ade9f4a44cb03e1",
            "tlsh": "73f0595166a3d19f77d69ac35f4190a0acb60a40b60ed0d5fa2c1bde00eeb13e9c54b0"
        },
        {
            "path": "package.json",
            "sha256": "42bd797ba1aa9f714c91816c77fe1082406ebc2de3bf76c3cae318268c39603a",
            "tlsh": "8b018e321d7668371ec477d3f9a2148577a248db4410a8495a9f423842ce53371ff33e"
        }
    ],
    "package_integrity": [
        {
            "filename": "modules-9.9.10.tgz",
            "hashes": {
                "sha1": "d398cfdd6dfb6c7e9bb917c9ecfbc05d4746bd97",
                "sha512_sri": "sha512-fpgjU+mj24R9GJLUQjKSBocGKp6ZZL9LJ/rP7LPZffxdAdQGTKA8THNVjWcduCJ7EOVyayXifyc8kNU+9wvIBA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@shared-runtime/modules/MAL-2026-16291.json"