@tvg-mar
LPM Firewall blocks 5 packages in the @tvg-mar npm scope. 3 have LPM's own review and are listed first.
An npm install script and the package entrypoint both run an obfuscated probe that encodes the username, hostname, and working-directory name into a DNS lookup for oob.algamil7x.xyz. That...
Install and import both execute an obfuscated DNS lookup that embeds local username, hostname, and project directory into a query for oob.algamil7x.xyz. That is concrete environment exfil...
The install entry unconditionally runs an obfuscated identity beacon to oob.algamil7x.xyz, which is unrelated to the GTM dataLayer API. Char-code hiding, swallowed errors, and a fake diag...
OpenSSF Malicious Packages via OSV confirms @tvg-mar/promos-context@9.9.10 as malicious (MAL-2026-16412): Malicious code in @tvg-mar/promos-context (npm)
OpenSSF Malicious Packages via OSV confirms @tvg-mar/storyblok-bridge@9.9.10 as malicious (MAL-2026-16414): Malicious code in @tvg-mar/storyblok-bridge (npm)