npm · Malicious package advisory
Malware@tvg-mar/utils
GHSA-g5mj-6q8x-7cj6
Malicious code in @tvg-mar/utils (npm)
Details
**Severity:** Critical
**Affected versions:** `= 9.9.10`
## Source: amazon-inspector (de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab)
package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstructs Node core APIs ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd', 'resolve4') and its destination domain from hex/char-code arrays at runtime, reads os.userInfo().username, os.hostname(), and process.cwd(), and encodes those values as labels of a subdomain under oob.algamil7x.xyz queried via dns.resolve4 — a DNS out-of-band exfiltration channel that fires automatically on npm install. Method names and the destination host are split across sibling files (d5a8c1.js, e6b9d2.js) and disguised with cover-story comments describing a benign 'registry mirror connectivity probe'.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/76398e59725721b4b1829aff3872e1f7fe84dabb/osv/malicious/npm/@tvg-mar/utils/MAL-2026-16416.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/76398e59725721b4b1829aff3872e1f7fe84dabb/osv/malicious/npm/@tvg-mar/utils/MAL-2026-16416.json
- https://www.npmjs.com/package/@tvg-mar/utils/v/9.9.10
- https://github.com/advisories/GHSA-g5mj-6q8x-7cj6Compromised versions (1)
- = 9.9.10
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.