{"id":"MAL-2026-16413","summary":"Malicious code in @tvg-mar/promos-gtm (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28)\n@tvg-mar/promos-gtm@9.9.10 executes an out-of-band DNS exfiltration routine both at install time (via a scripts.install hook running node index.js) and on require() (top-level module load chain reaching runtime/support/telemetry/probe/impl.js). The probe reads os.userInfo().username, os.hostname(), and process.cwd(), concatenates them with a timestamp and a prefix tag, and issues dns.resolve4 against a subdomain of a hardcoded attacker-controlled domain. The destination suffix (oob.algamil7x.xyz), prefix tag (tvggtm), Node built-in names (os, dns, process, userInfo, hostname, cwd, resolve4), and the internal _load API are stored as hex character-code arrays and reassembled at runtime via String.fromCharCode; the os and dns modules are loaded indirectly through module.constructor._load to further hide the behavior. The DNS channel bypasses typical HTTP egress controls and delivers installer host identifiers to attacker infrastructure with no relation to the package's advertised purpose.\n","modified":"2026-09-22T22:30:06.171348362Z","published":"2026-09-22T21:50:39Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["9.9.10"],"id":"IN-MAL-2026-020307","import_time":"2026-09-22T22:16:11.021718511Z","modified_time":"2026-09-22T21:50:39Z","sha256":"0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@tvg-mar/promos-gtm/v/9.9.10"}],"affected":[{"package":{"name":"@tvg-mar/promos-gtm","ecosystem":"npm","purl":"pkg:npm/%40tvg-mar/promos-gtm"},"versions":["9.9.10"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tvg-mar/promos-gtm/MAL-2026-16413.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"82db6ba80708c969d705d9c37f9ede060e94d314deb5b39805b4751553349be5","tlsh":"d9119c5af253d08f27c04a99391c53e1482d82d087dd50d1bb7c178ba2cd7918ad3e66","path":"runtime/support/telemetry/probe/impl.js"},{"path":"runtime/support/telemetry/probe/a9d1f4.js","sha256":"76103a448aaea3faa95bc52ae97b65e2d3e661b61073b9e2d6ae5b334aacf68f","tlsh":"34e0d82a219be14fa6d85aa73b16c5dac8420900e11d4ad9fa1d0687206e05681c0771"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-PPxuK5AIxTXTw7rb6l+Bh0HlBxNdNfixaCccCQGiZmNMweqQHj0QhXMdqItR7gbvt5mhTsrGSMfwh4c7wRB1tA==","sha1":"76de3c3b7123b42311cc42839e406d8ce36173ba"},"filename":"promos-gtm-9.9.10.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}