MAL-2026-16415

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369)

The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That file resolves the os and dns core modules indirectly through module.constructor._load with char-code-array names to avoid appearing in a normal require graph, then reads os.userInfo().username, os.hostname(), and the basename of process.cwd(). Those values are concatenated as DNS labels together with a hex-decoded destination domain and issued as a dns.resolve4 query to a subdomain of oob.algamil7x.xyz, a DNS-based out-of-band exfiltration collector. The destination hostname and the core-module names are stored as char-code arrays and decoded at runtime, and the logic is split across helper files (b2e6f8.js/c3f7a9.js) under a telemetry/probe cover directory. Every npm install of this version therefore leaks the installing user's username, machine hostname, and working-directory name to an attacker-controlled domain, and the obfuscation shows the destination and API surface were deliberately hidden.

Source: ghsa-malware (4c31038f30e69d193bebbd24c2516ac96e345889aa0e9c81a9f35afca8b7c044)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.