@insiderintelligence/googleadmanager

GHSA-76rx-jxhm-vhww

Malicious code in @insiderintelligence/googleadmanager (npm)

Details

**Severity:** Critical

**Affected versions:** `= 9.9.10`

## Source: amazon-inspector (a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5)
The package's `install` lifecycle script runs `node index.js`, which loads `lib/core.js`. On install, that module collects `os.userInfo().username`, `os.hostname()`, and the basename of the current working directory, then issues a `dns.resolve4` for a subdomain composed of those values under the hardcoded external domain `oob.algamil7x.xyz`. Module loads and the destination hostname are hex-array obfuscated: `lib/g7h8i9.js` uses `module.constructor._load` with hex-decoded strings to require `os`, `dns`, and `process`, and `lib/h8i9j0.js` stores the destination as hex arrays that decode to `oob.algamil7x.xyz`. The package name typosquats a legitimate ad-tech scope, and no functionality matching that stated purpose is present — the install-time DNS beacon is the package's only observable behavior.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1eebeb2966b8d7daea8d93addcfb920fba7f6a02/osv/malicious/npm/@insiderintelligence/googleadmanager/MAL-2026-16290.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/1eebeb2966b8d7daea8d93addcfb920fba7f6a02/osv/malicious/npm/@insiderintelligence/googleadmanager/MAL-2026-16290.json
- https://www.npmjs.com/package/@insiderintelligence/googleadmanager/v/9.9.10
- https://github.com/advisories/GHSA-76rx-jxhm-vhww

Compromised versions (1)

= 9.9.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.