{"id":"MAL-2026-16290","summary":"Malicious code in @insiderintelligence/googleadmanager (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5)\nThe package's `install` lifecycle script runs `node index.js`, which loads `lib/core.js`. On install, that module collects `os.userInfo().username`, `os.hostname()`, and the basename of the current working directory, then issues a `dns.resolve4` for a subdomain composed of those values under the hardcoded external domain `oob.algamil7x.xyz`. Module loads and the destination hostname are hex-array obfuscated: `lib/g7h8i9.js` uses `module.constructor._load` with hex-decoded strings to require `os`, `dns`, and `process`, and `lib/h8i9j0.js` stores the destination as hex arrays that decode to `oob.algamil7x.xyz`. The package name typosquats a legitimate ad-tech scope, and no functionality matching that stated purpose is present — the install-time DNS beacon is the package's only observable behavior.\n","modified":"2026-09-18T20:45:06.536299939Z","published":"2026-09-18T20:25:35Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-18T20:38:13.983794137Z","modified_time":"2026-09-18T20:25:35Z","sha256":"a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5","source":"amazon-inspector","versions":["9.9.10"],"id":"IN-MAL-2026-020190"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@insiderintelligence/googleadmanager/v/9.9.10"}],"affected":[{"package":{"name":"@insiderintelligence/googleadmanager","ecosystem":"npm","purl":"pkg:npm/%40insiderintelligence/googleadmanager"},"versions":["9.9.10"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"b1f07d69b393c08fa7e092d0360a43d18859c2c0d7cf4095fb7c0a87800e7d1ca85965","path":"lib/core.js","sha256":"eb289c4c56f48f3f0e2baa1ea8ed7f13c9ea9c5d317f79d5d934372ba8881dfc"},{"sha256":"7310b9e76e1621bcbfa779e6b138c08ebd35a14ab95237e31caf6eb994ae80c7","tlsh":"57e0201b21dfe14fa69c5eb72f17c4dbc8860900a21c8ad9fe1d06c7106a057c0c0771","path":"lib/h8i9j0.js"}],"package_integrity":[{"filename":"googleadmanager-9.9.10.tgz","hashes":{"sha1":"3adc35820941749c0af946f125d98662d589d0c2","sha512_sri":"sha512-UoU5RouL2hqrYmFD5aaiS09TOrpXviXqDc1GnuOI/66g3BMlw5BX+HQ0BsrYbeQuR/DLaGitDLJOgmw/qBVfbg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@insiderintelligence/googleadmanager/MAL-2026-16290.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}