{"id":"MAL-2026-16379","summary":"Malicious code in @user-services/web-components (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b)\n@user-services/web-components@9.9.10 fires a hidden telemetry probe on both the npm install lifecycle (`node index.js`) and on every `require()` of the module. The probe in probe/impl.js reads os.userInfo().username, os.hostname() and the basename of process.cwd(), concatenates them with a prefix `uswc` and a timestamp into a subdomain of `oob.algamil7x.xyz`, and issues a `dns.resolve4` query — the query name itself is the exfiltration channel, delivering installer identity to the attacker-controlled authoritative nameserver. The exfil pipeline is deliberately hidden from static analysis: supporting modules (b8d6e3.js, c9e7f4.js) reconstruct the strings `os`, `dns`, `process`, `userInfo`, `hostname`, `cwd`, `resolve4` and the destination host `oob.algamil7x.xyz` from `String.fromCharCode` byte arrays, and load the `os` and `dns` core modules via `module.constructor._load(...)` instead of a static `require`. The destination host is not the declared homepage and is not documented anywhere in the package. The scope `@user-services` and its placeholder repository/author metadata (`github.com/user-services/web-components`, `eng@user-services.dev`) are generic and consistent with a dependency-confusion lure aimed at organisations with an internal `@user-services/*` scope.\n","modified":"2026-09-22T14:30:06.925629431Z","published":"2026-09-22T13:57:51Z","database_specific":{"malicious-packages-origins":[{"sha256":"02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b","source":"amazon-inspector","versions":["9.9.10"],"id":"IN-MAL-2026-020286","import_time":"2026-09-22T14:19:07.710077681Z","modified_time":"2026-09-22T13:57:51Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@user-services/web-components/v/9.9.10"}],"affected":[{"package":{"name":"@user-services/web-components","ecosystem":"npm","purl":"pkg:npm/%40user-services/web-components"},"versions":["9.9.10"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@user-services/web-components/MAL-2026-16379.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"303e024d53affd063c83f1f13df4d0cfd14754e462e96d1ccd4ebc4b0e8ebb00","tlsh":"78119c5ab253d08f23c04695391c43e1882ec2d087cd10d1bbbc279ba28d7914ad3a66","path":"runtime/support/telemetry/probe/impl.js"},{"tlsh":"e9e0201b219fe14fa6d85ea73f17c5dac8420900e21d8ad9fa1d4787106a406c0c0770","path":"runtime/support/telemetry/probe/c9e7f4.js","sha256":"8abb9d677003e4dbdfe9ed14dc47eca3b9023a66c935989b593ba61d1b58e5cf"},{"path":"package.json","sha256":"554de13e4624f1bbdd4ef2a958dcbff646058685492ba1f458c2c8f4d4950cce","tlsh":"ef110821856394331ad03ba09d76284b73a74856cde2bc0c17f7592483ced9a10fe37a"}],"package_integrity":[{"filename":"web-components-9.9.10.tgz","hashes":{"sha512_sri":"sha512-UOG7X/AW829XHcu1iR2ujidCrJFuSn2H6W5NKsxDc7piQHSUtGdWMU6ErpMecnY3Mb1PLzrL76VlRfi8huDVLQ==","sha1":"c3dc537969fc56745a73204da81b3063b562f534"}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}