MAL-2026-16291

    Dashboard / Malicious Package / MAL-2026-16291

    MAL-2026-16291

    Published: 18 Sept 2026Last Modified: 18 Sept 2026

    Summary: Malicious code in @shared-runtime/modules (npm)

    Details: Source: amazon-inspector (bc6095cf4766c948193c22d8c0e775010fc3ab47733a1020fb8fd5367d88e5e9) @shared-runtime/[email protected] collects the installer's OS username (os.userInfo().username), hostname (os.hostname()) and current working-directory basename, then issues a dns.resolve4() query against a subdomain assembled as srmods.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz, leaking those values via authoritative DNS logs at the attacker-controlled domain oob.algamil7x.xyz. The destination hostname, the OS/DNS API names, and the module names are stored as hex byte arrays in lib/a74d1f.js and lib/f63c0e.js and reconstructed at runtime via String.fromCharCode, with os and dns loaded through module.constructor._load to avoid literal require() strings. Execution is triggered both at install (package.json scripts.install="node index.js") and on require() (index.js top-level require('./lib/core.js')), with a swallowed try/catch so npm install still reports success. The README claims no hidden network calls in module scope while module scope performs exactly that.

    References: https://www.npmjs.com/package/@shared-runtime/modules/v/9.9.10

    Affected packages

    Package

    Name: @shared-runtime/modules

    Purl: pkg:npm/%40shared-runtime/modules

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9.9.10