MAL-2026-16415

Dashboard / Malicious Package / MAL-2026-16415

MAL-2026-16415

Summary: Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

Details: Source: amazon-inspector (22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369) The package's package.json declares an `install` lifecycle script that runs `node index.js`, which loads `runtime/support/telemetry/probe/impl.js`. That file resolves the `os` and `dns` core modules indirectly through `module.constructor._load` with char-code-array names to avoid appearing in a normal `require` graph, then reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`. Those values are concatenated as DNS labels together with a hex-decoded destination domain and issued as a `dns.resolve4` query to a subdomain of `oob.algamil7x.xyz`, a DNS-based out-of-band exfiltration collector. The destination hostname and the core-module names are stored as char-code arrays and decoded at runtime, and the logic is split across helper files (b2e6f8.js/c3f7a9.js) under a `telemetry/probe` cover directory. Every `npm install` of this version therefore leaks the installing user's username, machine hostname, and working-directory name to an attacker-controlled domain, and the obfuscation shows the destination and API surface were deliberately hidden. Source: ghsa-malware (4c31038f30e69d193bebbd24c2516ac96e345889aa0e9c81a9f35afca8b7c044) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://www.npmjs.com/package/@tvg-mar/tvg-promos-atomic-ui/v/9.9.10, https://github.com/advisories/GHSA-gj3c-r86r-hr43