MAL-2026-16379

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b) @user-services/web-components@9.9.10 fires a hidden telemetry probe on both the npm install lifecycle (`node index.js`) and on every `require()` of the module. The probe in probe/impl.js reads os.userInfo().username, os.hostname() and the basename of process.cwd(), concatenates them with a prefix `uswc` and a timestamp into a subdomain of `oob.algamil7x.xyz`, and issues a `dns.resolve4` query — the query name itself is the exfiltration channel, delivering installer identity to the attacker-controlled authoritative nameserver. The exfil pipeline is deliberately hidden from static analysis: supporting modules (b8d6e3.js, c9e7f4.js) reconstruct the strings `os`, `dns`, `process`, `userInfo`, `hostname`, `cwd`, `resolve4` and the destination host `oob.algamil7x.xyz` from `String.fromCharCode` byte arrays, and load the `os` and `dns` core modules via `module.constructor._load(...)` instead of a static `require`. The destination host is not the declared homepage and is not documented anywhere in the package. The scope `@user-services` and its placeholder repository/author metadata (`github.com/user-services/web-components`, `eng@user-services.dev`) are generic and consistent with a dependency-confusion lure aimed at organisations with an internal `@user-services/*` scope.