@shared-runtime/modules

GHSA-g85c-jph7-8q4r

Malicious code in @shared-runtime/modules (npm)

Details

**Severity:** Critical

**Affected versions:** `= 9.9.10`

## Source: amazon-inspector (bc6095cf4766c948193c22d8c0e775010fc3ab47733a1020fb8fd5367d88e5e9)
@shared-runtime/[email protected] collects the installer's OS username (os.userInfo().username), hostname (os.hostname()) and current working-directory basename, then issues a dns.resolve4() query against a subdomain assembled as srmods.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz, leaking those values via authoritative DNS logs at the attacker-controlled domain oob.algamil7x.xyz. The destination hostname, the OS/DNS API names, and the module names are stored as hex byte arrays in lib/a74d1f.js and lib/f63c0e.js and reconstructed at runtime via String.fromCharCode, with os and dns loaded through module.constructor._load to avoid literal require() strings. Execution is triggered both at install (package.json scripts.install="node index.js") and on require() (index.js top-level require('./lib/core.js')), with a swallowed try/catch so npm install still reports success. The README claims no hidden network calls in module scope while module scope performs exactly that.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1eebeb2966b8d7daea8d93addcfb920fba7f6a02/osv/malicious/npm/@shared-runtime/modules/MAL-2026-16291.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/1eebeb2966b8d7daea8d93addcfb920fba7f6a02/osv/malicious/npm/@shared-runtime/modules/MAL-2026-16291.json
- https://www.npmjs.com/package/@shared-runtime/modules/v/9.9.10
- https://github.com/advisories/GHSA-g85c-jph7-8q4r

Compromised versions (1)

= 9.9.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.