{"id":"MAL-2026-16412","summary":"Malicious code in @tvg-mar/promos-context (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3)\nThe package's `install` lifecycle script runs `node index.js`, which loads `runtime/support/telemetry/probe/impl.js`. On every `npm install`, that module dynamically resolves the `os` and `dns` core modules via `module.constructor._load` with char-code-obfuscated names, reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`, and encodes them as DNS labels in a `dns.resolve4` query to `oob.algamil7x.xyz`. The destination domain is reconstructed at runtime from a hex char-code array in `runtime/support/telemetry/probe/d4c8a1.js` / `e5d9b2.js` rather than appearing as a plain string. The combination of an install-time hook, obfuscated core-module loading, obfuscated destination, and DNS-tunnel encoding of installer identity fields is a classic install-time exfiltration beacon.\n","modified":"2026-09-22T22:30:05.620112071Z","published":"2026-09-22T21:50:59Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-22T22:16:11.15845885Z","modified_time":"2026-09-22T21:50:59Z","sha256":"68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3","source":"amazon-inspector","versions":["9.9.10"],"id":"IN-MAL-2026-020309"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@tvg-mar/promos-context/v/9.9.10"}],"affected":[{"package":{"name":"@tvg-mar/promos-context","ecosystem":"npm","purl":"pkg:npm/%40tvg-mar/promos-context"},"versions":["9.9.10"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tvg-mar/promos-context/MAL-2026-16412.json","indicators":{"evidence_files":[{"tlsh":"7211995af353d08f27c04699391c43e1882e82d09bcd51d2bbbc168ba2cd7904ad3aa6","path":"runtime/support/telemetry/probe/impl.js","sha256":"9a8eb1bc035e262ea563747655c939baa0a0f2833db40a572a0a55824f2a3025"},{"tlsh":"73f0595166a3d19f77d69ac35f4190a0acb60a40b60ed0d5fa2c1bde00eeb13e9c54b0","path":"runtime/support/telemetry/probe/d4c8a1.js","sha256":"f7942b52b33a05f44ce43c1cc581fa1140cbbef03acdba961ade9f4a44cb03e1"}],"package_integrity":[{"filename":"promos-context-9.9.10.tgz","hashes":{"sha1":"38049fba0d634eef5a54d799c169b5482f4b58ec","sha512_sri":"sha512-Rh/0BkyrYE9VDluna7RrGUFF2UY3SsYK9CqPUU2PqK7fHDaxY0RdN0fjeKHxiYTuscEMnvzB4fCEDhatgpKVdw=="}}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}