{"id":"MAL-2026-16414","summary":"Malicious code in @tvg-mar/storyblok-bridge (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af)\nThe package's `scripts.install` runs `node index.js`, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loads Node built-ins `os`, `dns`, and `process` via `module.constructor._load` using names reconstructed from `String.fromCharCode` char-code arrays, then reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`, concatenates them with a timestamp and the static prefix `tvgsb`, and issues `dns.resolve4` against a subdomain of `oob.algamil7x.xyz` (a domain and API names likewise reconstructed from char-code arrays). The result is a covert DNS out-of-band channel that leaks installer host identifiers on every `npm install`, using DNS to bypass HTTP egress filtering. The obfuscation of standard built-ins and of the destination domain has no benign purpose and is paired directly with the exfiltration primitive.\n","modified":"2026-09-22T22:30:06.168566629Z","published":"2026-09-22T21:50:31Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-22T22:16:10.94932379Z","modified_time":"2026-09-22T21:50:31Z","sha256":"5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af","source":"amazon-inspector","versions":["9.9.10"],"id":"IN-MAL-2026-020306"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@tvg-mar/storyblok-bridge/v/9.9.10"}],"affected":[{"package":{"name":"@tvg-mar/storyblok-bridge","ecosystem":"npm","purl":"pkg:npm/%40tvg-mar/storyblok-bridge"},"versions":["9.9.10"],"database_specific":{"indicators":{"evidence_files":[{"path":"runtime/support/telemetry/probe/impl.js","sha256":"e9bbc0c7bb2e2f8977ae761c651dc9ee5369db09bc48fe51cd38658e8a1535e9","tlsh":"6a119c5ab253d08f23c04699391c43e1482ec2d09bdd51d2bbbc168ba2cd7904ad3aa6"},{"sha256":"f7942b52b33a05f44ce43c1cc581fa1140cbbef03acdba961ade9f4a44cb03e1","tlsh":"73f0595166a3d19f77d69ac35f4190a0acb60a40b60ed0d5fa2c1bde00eeb13e9c54b0","path":"runtime/support/telemetry/probe/f6e0c3.js"}],"package_integrity":[{"filename":"storyblok-bridge-9.9.10.tgz","hashes":{"sha1":"56806b7d85cbb88834fa0385e1a652868f4337f4","sha512_sri":"sha512-0Vtec4BUCourspuvqSGtpDvmaZt8KpoBvj+J6x/INlTg5E4Vsh7rmYFG78MFSzcwQ+IrQO7PVhFFCtIBEqisFg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tvg-mar/storyblok-bridge/MAL-2026-16414.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}