registry / @tvg-mar/promos-gtm / 9.9.10

@tvg-mar/promos-gtm@9.9.10

GTM integration for promo surfaces: dataLayer, events and consent

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Install and import execute an obfuscated DNS lookup that encodes the machine username, hostname, and current directory name into a name under oob.algamil7x.xyz. The lookup is disguised as a registry connectivity probe and errors are ignored.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install runs node index.js, and any require of the package entry calls the same runtime bootstrap.

Impact

A remote DNS listener at the decoded zone can learn who installed the package and which project directory was current, while installation still succeeds.

Mechanism

index.js loads runtime/index.js, which calls support.initialize. Telemetry then runs the probe, whose module loads impl.js. That file immediately collects identity fields and calls dns.resolve4 with a label-encoded query.

Attack narrative

npm install and any load of the package entry run index.js, which invokes the runtime bootstrap before exporting the GTM helpers. Telemetry then loads the probe, which requires impl.js, and that file runs at once. It reads the OS username, hostname, and current directory base name through obfuscated os and process access, joins them with a time value, and calls dns.resolve4 on the resulting name under oob.algamil7x.xyz. Errors are caught so the install looks successful while the DNS query can reveal who installed the package and from which project directory.

AI rationale

The install entry unconditionally runs an obfuscated identity beacon to oob.algamil7x.xyz, which is unrelated to the GTM dataLayer API. Char-code hiding, swallowed errors, and a fake diagnostic comment show deliberate covert collection on install and import.

Evidence

package.jsonindex.jsruntime/index.jsruntime/support/telemetry/index.jsruntime/support/telemetry/probe/index.js

@tvg-mar/promos-gtm@9.9.10 executes an out-of-band DNS exfiltration routine both at install time (via a scripts.install hook running node index.js) and on require() (top-level module load chain reaching runtime/support/telemetry/probe/impl.js). The probe reads os.userInfo().username, os.hostname(), and process.cwd(), concatenates them with a timestamp and a prefix tag, and issues dns.resolve4 against a subdomain of a hardcoded attacker-controlled domain. The destination suffix (oob.algamil7x.xyz), prefix tag (tvggtm), Node built-in names (os, dns, process, userInfo, hostname, cwd, resolve4), and the internal _load API are stored as hex character-code arrays and reassembled at runtime via String.fromCharCode; the os and dns modules are loaded indirectly through module.constructor._load to further hide the behavior. The DNS channel bypasses typical HTTP egress controls and delivers installer host identifiers to attacker infrastructure with no relation to the package's advertised purpose.

@tvg-mar/promos-gtm@9.9.10

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code