@tvg-mar/promos-gtm

GHSA-4mmr-x347-r6gv

Malicious code in @tvg-mar/promos-gtm (npm)

Details

**Severity:** Critical

**Affected versions:** `= 9.9.10`

## Source: amazon-inspector (0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28)
@tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time (via a scripts.install hook running node index.js) and on require() (top-level module load chain reaching runtime/support/telemetry/probe/impl.js). The probe reads os.userInfo().username, os.hostname(), and process.cwd(), concatenates them with a timestamp and a prefix tag, and issues dns.resolve4 against a subdomain of a hardcoded attacker-controlled domain. The destination suffix (oob.algamil7x.xyz), prefix tag (tvggtm), Node built-in names (os, dns, process, userInfo, hostname, cwd, resolve4), and the internal _load API are stored as hex character-code arrays and reassembled at runtime via String.fromCharCode; the os and dns modules are loaded indirectly through module.constructor._load to further hide the behavior. The DNS channel bypasses typical HTTP egress controls and delivers installer host identifiers to attacker infrastructure with no relation to the package's advertised purpose.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/76398e59725721b4b1829aff3872e1f7fe84dabb/osv/malicious/npm/@tvg-mar/promos-gtm/MAL-2026-16413.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/76398e59725721b4b1829aff3872e1f7fe84dabb/osv/malicious/npm/@tvg-mar/promos-gtm/MAL-2026-16413.json
- https://www.npmjs.com/package/@tvg-mar/promos-gtm/v/9.9.10
- https://github.com/advisories/GHSA-4mmr-x347-r6gv

Compromised versions (1)

= 9.9.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.