@shared-web/utils

Details

**Severity:** Critical

**Affected versions:** `= 9.9.10`

## Source: amazon-inspector (5425b12d827e5327939280ed16ddd0a613b28d0d728a0a8b193f342a666c65e9)
package.json declares scripts.install: node index.js, which loads lib/core.js. On npm install, that module reads os.userInfo().username, os.hostname(), and the current working directory basename, concatenates them with a fixed 'swutils' prefix and a timestamp using '.' as separators, and issues a dns.resolve4() query for the resulting label under a hardcoded out-of-band domain oob.algamil7x.xyz. The destination domain, the prefix, and the Node built-in module names ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd', 'resolve4', '_load') are stored as hex byte arrays in lib/a9b3de.js and lib/f8a2cd.js and reassembled at runtime via String.fromCharCode, with the runtime imported through module.constructor._load rather than a normal require. The library exposes no documented functionality that would motivate hiding its DNS destination or Node built-in module names. The result is a DNS-tunnel exfiltration of installer identity (username, host, cwd) to a non-first-party domain that fires automatically on every install.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1eebeb2966b8d7daea8d93addcfb920fba7f6a02/osv/malicious/npm/@shared-web/utils/MAL-2026-16292.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/1eebeb2966b8d7daea8d93addcfb920fba7f6a02/osv/malicious/npm/@shared-web/utils/MAL-2026-16292.json
- https://www.npmjs.com/package/@shared-web/utils/v/9.9.10
- https://github.com/advisories/GHSA-29f7-pqf4-c94j

Compromised versions (1)

• = 9.9.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.