MAL-2026-16292

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@shared-web/utils/MAL-2026-16292.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16292
Published
2026-09-18T20:25:56Z
Modified
2026-09-18T20:45:06Z
Summary
Malicious code in @shared-web/utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5425b12d827e5327939280ed16ddd0a613b28d0d728a0a8b193f342a666c65e9)

package.json declares scripts.install: node index.js, which loads lib/core.js. On npm install, that module reads os.userInfo().username, os.hostname(), and the current working directory basename, concatenates them with a fixed 'swutils' prefix and a timestamp using '.' as separators, and issues a dns.resolve4() query for the resulting label under a hardcoded out-of-band domain oob.algamil7x.xyz. The destination domain, the prefix, and the Node built-in module names ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd', 'resolve4', '_load') are stored as hex byte arrays in lib/a9b3de.js and lib/f8a2cd.js and reassembled at runtime via String.fromCharCode, with the runtime imported through module.constructor._load rather than a normal require. The library exposes no documented functionality that would motivate hiding its DNS destination or Node built-in module names. The result is a DNS-tunnel exfiltration of installer identity (username, host, cwd) to a non-first-party domain that fires automatically on every install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020192",
            "import_time": "2026-09-18T20:38:14.115437652Z",
            "modified_time": "2026-09-18T20:25:56Z",
            "sha256": "5425b12d827e5327939280ed16ddd0a613b28d0d728a0a8b193f342a666c65e9",
            "source": "amazon-inspector",
            "versions": [
                "9.9.10"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @shared-web/utils

Package

Name
@shared-web/utils
View open source insights on deps.dev
Purl
pkg:npm/%40shared-web/utils

Affected ranges

Affected versions

9.*
9.9.10

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/core.js",
            "sha256": "e8db4e234f8aca0a53f56e9bde4aa9bd939d30fa32bae71ef6922650fda47395",
            "tlsh": "3af02d69b393c48f97e096d1360a53d18859c2c0e7cf4195f7bc4a87904e7d1cac596a"
        },
        {
            "path": "lib/f8a2cd.js",
            "sha256": "f7942b52b33a05f44ce43c1cc581fa1140cbbef03acdba961ade9f4a44cb03e1",
            "tlsh": "73f0595166a3d19f77d69ac35f4190a0acb60a40b60ed0d5fa2c1bde00eeb13e9c54b0"
        }
    ],
    "package_integrity": [
        {
            "filename": "utils-9.9.10.tgz",
            "hashes": {
                "sha1": "b10d2340c3c76712deb370e44304acdacdba5b60",
                "sha512_sri": "sha512-2G+TNP9wmKgx9pG5o9jlridw0kxtmz6vkY/H0VAfwsHFEluZiX94KzOLo9uFwdr/x/XrZFS+iDQTwSOzfnTqcg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@shared-web/utils/MAL-2026-16292.json"