{"id":"MAL-2026-16378","summary":"Malicious code in @tesla-insurance/vinless-quote (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730)\nThe package declares an `install` lifecycle script (`node index.js`) that loads `runtime/support/telemetry/probe/impl.js`. On `npm install`, this probe collects the OS username (`os.userInfo().username`), hostname (`os.hostname()`), and the basename of the current working directory, joins them with a static prefix into a DNS label, and issues `dns.resolve4()` against a subdomain of `oob.algamil7x.xyz` — a covert DNS-based exfiltration channel that bypasses HTTP egress filtering. Both the destination host and the module names (`os`, `dns`, `process`) are obfuscated as `String.fromCharCode` byte arrays, and modules are loaded via `module.constructor._load` rather than plain `require`, hiding the hostile endpoint and the primitives used to reach it. The package is published under a vendor-branded scope (`@tesla-insurance/vinless-quote`) unrelated to the attacker domain, consistent with a social-engineering wrapper around the exfiltration payload.\n","modified":"2026-09-22T14:30:06.914211873Z","published":"2026-09-22T13:58:00Z","database_specific":{"malicious-packages-origins":[{"versions":["9.9.10"],"id":"IN-MAL-2026-020287","import_time":"2026-09-22T14:19:07.778563567Z","modified_time":"2026-09-22T13:58:00Z","sha256":"4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@tesla-insurance/vinless-quote/v/9.9.10"}],"affected":[{"package":{"name":"@tesla-insurance/vinless-quote","ecosystem":"npm","purl":"pkg:npm/%40tesla-insurance/vinless-quote"},"versions":["9.9.10"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"a5973b004a66466c59213d45510643ad64f0f751d542d9f8ee289ddd4080e326","tlsh":"a6119c5ab353d08f23c04699391c53e1882e82d097dd50d1bb7c169ba2cd7914ad3aa6","path":"runtime/support/telemetry/probe/impl.js"},{"tlsh":"9ce0202b11dff14fa6dc5eab2f17c4dac8820900e21d4ad9f90d178b206a016d1c0771","path":"runtime/support/telemetry/probe/a3b9d5.js","sha256":"aee8240b3d83961c1a0e3c35b35faa68bf199ddb2120a676f251c86202a19425"},{"path":"package.json","sha256":"896b702ed9b4931bc518075964c1a72e30ece345e9ede6041adb3997b95b95c7","tlsh":"d8118c550733cc131ee0be42ea931a03736369168a46adc942eb442297cda3730fe67d"}],"package_integrity":[{"hashes":{"sha1":"450e80159990a78199a8c5d3652248911e1c9276","sha512_sri":"sha512-jkJJNWJB+1E1atb+SOay1MODtGWzIYoeg5fMJVSzv7AmK4roTTSqZRPrKnspwmJjrrZK6SjApiE+dRSI6AzbFw=="},"filename":"vinless-quote-9.9.10.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tesla-insurance/vinless-quote/MAL-2026-16378.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}