registry / @tvg-mar/tvg-promos-atomic-ui / 9.9.10

@tvg-mar/tvg-promos-atomic-ui@9.9.10

Atomic UI components for promo surfaces

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Installing or importing this package runs an obfuscated probe that encodes the local username, hostname, and working-directory name into a DNS lookup for oob.algamil7x.xyz. The lookup fires from an immediately invoked function when impl.js is loaded, and errors are swallowed.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install runs node index.js, and any require of the package main also calls the runtime bootstrap.

Impact

A remote operator learns who installed or imported the package, on which machine, and in which project directory, without any user-facing prompt.

Mechanism

The bootstrap starts telemetry, which loads impl.js. That file reads os.userInfo().username, os.hostname, and the last segment of process.cwd, then calls dns.resolve4 on a hostname built from those values, a timestamp, and oob.algamil7x.xyz.

Attack narrative

On npm install, package.json runs node index.js. That file immediately calls the runtime bootstrap, which starts a telemetry probe. Loading the probe pulls in impl.js, whose startup function reads the OS username, hostname, and current directory name through obfuscated os and process access. It joins those values with a timestamp and the hidden host oob.algamil7x.xyz, then issues dns.resolve4. The query itself delivers the host identity to that domain. The same path runs on ordinary import, and failures are caught so the UI export still succeeds.

AI rationale

Install and import both execute an obfuscated DNS lookup that embeds local username, hostname, and project directory into a query for oob.algamil7x.xyz. That is concrete environment exfiltration, not a registry health check.

Evidence

package.jsonindex.jsruntime/index.jsruntime/support/telemetry/index.jsruntime/support/telemetry/probe/index.js

The package's package.json declares an `install` lifecycle script that runs `node index.js`, which loads `runtime/support/telemetry/probe/impl.js`. That file resolves the `os` and `dns` core modules indirectly through `module.constructor._load` with char-code-array names to avoid appearing in a normal `require` graph, then reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`. Those values are concatenated as DNS labels together with a hex-decoded destination domain and issued as a `dns.resolve4` query to a subdomain of `oob.algamil7x.xyz`, a DNS-based out-of-band exfiltration collector. The destination hostname and the core-module names are stored as char-code arrays and decoded at runtime, and the logic is split across helper files (b2e6f8.js/c3f7a9.js) under a `telemetry/probe` cover directory. Every `npm install` of this version therefore leaks the installing user's username, machine hostname, and working-directory name to an attacker-controlled domain, and the obfuscation shows the destination and API surface were deliberately hidden.

@tvg-mar/tvg-promos-atomic-ui@9.9.10

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code