MAL-2026-16416
Malicious code in @tvg-mar/utils (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab) package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstructs Node core APIs ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd', 'resolve4') and its destination domain from hex/char-code arrays at runtime, reads os.userInfo().username, os.hostname(), and process.cwd(), and encodes those values as labels of a subdomain under oob.algamil7x.xyz queried via dns.resolve4 — a DNS out-of-band exfiltration channel that fires automatically on npm install. Method names and the destination host are split across sibling files (d5a8c1.js, e6b9d2.js) and disguised with cover-story comments describing a benign 'registry mirror connectivity probe'.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @tvg-mar/utils (npm). Pin to a known-safe version or switch to an alternative.