@user-services/web-components

GHSA-6q28-qx7w-pv4x

Malicious code in @user-services/web-components (npm)

Details

**Severity:** Critical

**Affected versions:** `= 9.9.10`

## Source: amazon-inspector (02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b)
@user-services/[email protected] fires a hidden telemetry probe on both the npm install lifecycle (`node index.js`) and on every `require()` of the module. The probe in probe/impl.js reads os.userInfo().username, os.hostname() and the basename of process.cwd(), concatenates them with a prefix `uswc` and a timestamp into a subdomain of `oob.algamil7x.xyz`, and issues a `dns.resolve4` query — the query name itself is the exfiltration channel, delivering installer identity to the attacker-controlled authoritative nameserver. The exfil pipeline is deliberately hidden from static analysis: supporting modules (b8d6e3.js, c9e7f4.js) reconstruct the strings `os`, `dns`, `process`, `userInfo`, `hostname`, `cwd`, `resolve4` and the destination host `oob.algamil7x.xyz` from `String.fromCharCode` byte arrays, and load the `os` and `dns` core modules via `module.constructor._load(...)` instead of a static `require`. The destination host is not the declared homepage and is not documented anywhere in the package. The scope `@user-services` and its placeholder repository/author metadata (`github.com/user-services/web-components`, `[email protected]`) are generic and consistent with a dependency-confusion lure aimed at organisations with an internal `@user-services/*` scope.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/93f5690fa3407c473772bcaade41b8b92c4b22bd/osv/malicious/npm/@user-services/web-components/MAL-2026-16379.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/93f5690fa3407c473772bcaade41b8b92c4b22bd/osv/malicious/npm/@user-services/web-components/MAL-2026-16379.json
- https://www.npmjs.com/package/@user-services/web-components/v/9.9.10
- https://github.com/advisories/GHSA-6q28-qx7w-pv4x

Compromised versions (1)

= 9.9.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.