@insiderintelligence/componentlibrary

Details

**Severity:** Critical

**Affected versions:** `= 9.9.10`

## Source: amazon-inspector (a4451c41559202c6bce3218de9af47cabe20288af5f3a9240076f25b3b2b5993)
The package declares scripts.install: node index.js, so npm install auto-executes index.js which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo().username, os.hostname(), and the current working directory's leaf name, joins them with a fixed prefix (iiclib) and a timestamp into a subdomain label, and issues a dns.resolve4() query against oob.algamil7x.xyz — exfiltrating installer identity via a DNS side-channel that bypasses HTTP egress controls. The destination host, the module names ('os','dns','process'), and the resolved API names ('userInfo','hostname','cwd','resolve4','_load') are hidden behind String.fromCharCode arrays in sibling helpers a8e4c9.js and f7d3b8.js, and the module is loaded via module.constructor._load through encoded literals to disguise the primitive as a 'connectivity probe'. The same path also runs on require() because index.js is the package main. The behavior has no connection to the package's stated component-library purpose.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1b9f031b65c0c7f49c13fdbadbedf5b95af9ce9c/osv/malicious/npm/@insiderintelligence/componentlibrary/MAL-2026-16353.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/1b9f031b65c0c7f49c13fdbadbedf5b95af9ce9c/osv/malicious/npm/@insiderintelligence/componentlibrary/MAL-2026-16353.json
- https://www.npmjs.com/package/@insiderintelligence/componentlibrary/v/9.9.10
- https://github.com/advisories/GHSA-5h4w-mvwx-ff8q

Compromised versions (1)

• = 9.9.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.