MAL-2026-16353

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@insiderintelligence/componentlibrary/MAL-2026-16353.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-16353

Published

2026-09-21T17:14:44Z

Modified

2026-09-21T17:45:06Z

Summary

Malicious code in @insiderintelligence/componentlibrary (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a4451c41559202c6bce3218de9af47cabe20288af5f3a9240076f25b3b2b5993)

The package declares scripts.install: node index.js, so npm install auto-executes index.js which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo().username, os.hostname(), and the current working directory's leaf name, joins them with a fixed prefix (iiclib) and a timestamp into a subdomain label, and issues a dns.resolve4() query against oob.algamil7x.xyz — exfiltrating installer identity via a DNS side-channel that bypasses HTTP egress controls. The destination host, the module names ('os','dns','process'), and the resolved API names ('userInfo','hostname','cwd','resolve4','_load') are hidden behind String.fromCharCode arrays in sibling helpers a8e4c9.js and f7d3b8.js, and the module is loaded via module.constructor._load through encoded literals to disguise the primitive as a 'connectivity probe'. The same path also runs on require() because index.js is the package main. The behavior has no connection to the package's stated component-library purpose.

Database specific

{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020262",
            "import_time":  "2026-09-21T17:38:31.452503065Z",
            "modified_time":  "2026-09-21T17:14:44Z",
            "sha256":  "a4451c41559202c6bce3218de9af47cabe20288af5f3a9240076f25b3b2b5993",
            "source":  "amazon-inspector",
            "versions":  [
                "9.9.10"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/@insiderintelligence/componentlibrary/v/9.9.10

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / @insiderintelligence/componentlibrary

Package

Name: @insiderintelligence/componentlibrary; View open source insights on deps.dev
Purl: pkg:npm/%40insiderintelligence/componentlibrary

Affected ranges

Affected versions

9.*

9.9.10

Database specific

cwes

[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files":  [
        {
            "path":  "runtime/support/telemetry/probe/impl.js",
            "sha256":  "193fd98a2ce3086b746b4f1bdee26f264cbc3af039b679c01f628a4da8b27894",
            "tlsh":  "02119c5ab253d08f23d04699391c43e1482d82d087dd51d1bb7c178ba2cd7908ad3aa6"
        },
        {
            "path":  "runtime/support/telemetry/probe/a8e4c9.js",
            "sha256":  "e7d5a508a321634f66d4e86e39b38f1d8c61e56bc3b6a6513931abbb6dcd463a",
            "tlsh":  "37e0201b21efe14fa69c5ea71f17d4dbc8c70d00a21c4ad9f90d168710aa016c0c0770"
        },
        {
            "path":  "package.json",
            "sha256":  "1481d3bd55b35ce71f9cc34bc627616dbe1e15965b05f1b2ac20c5be9e4db759",
            "tlsh":  "4e1176754ba604632be42649ebb82c0eb2621c4b859a6c442bf7482086cf03641be3fd"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "componentlibrary-9.9.10.tgz",
            "hashes":  {
                "sha1":  "c323f4ce3cab40d863fe8855ba1a3e0d9f0fe5ce",
                "sha512_sri":  "sha512-KoqLjVvmPOJAvFQAuOpqMQRxUeTa+VK/8L/qVsHLopst3mVnfCFsWkaxturrwRt5TfB57g9A6bIDhKOzMzIAcA=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@insiderintelligence/componentlibrary/MAL-2026-16353.json"