@nf-addons/am-global-header

GHSA-hj7v-p563-fffq

Malicious code in @nf-addons/am-global-header (npm)

Details

**Severity:** Critical

**Affected versions:** `= 9.9.10`

## Source: amazon-inspector (5f4f7297a2ae76eee65506183462a7138df6115ee2bfad9c84878b7f3c7998c8)
The package's `install` lifecycle script runs `node index.js`, which loads `runtime/support/telemetry/probe/impl.js`. That module reads `os.userInfo().username`, `os.hostname()`, and `process.cwd()`, concatenates them with a fixed prefix `nfamh` and a timestamp into a single DNS label, and issues a `dns.resolve4` query against the hardcoded domain `oob.algamil7x.xyz`, exfiltrating installer identity over DNS on `npm install`. The same code path also fires on every `require()` of the package via the declared `main`. Destination domain, the loader targets `os`/`dns`, and the identifiers `userInfo`/`hostname`/`cwd`/`resolve4` are stored as charcode/hex arrays and reconstructed at runtime via `String.fromCharCode`, and the `os` and `dns` modules are pulled in through `module.constructor._load` rather than `require`, concealing the destination and API surface from static inspection. Comments frame the behavior as `registry connectivity diagnostics`, contradicting the actual dataflow.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/@nf-addons/am-global-header/MAL-2026-17154.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/70a54c64ed12966f820d7ef17b912c81c4a2d56d/osv/malicious/npm/@nf-addons/am-global-header/MAL-2026-17154.json
- https://www.npmjs.com/package/@nf-addons/am-global-header/v/9.9.10
- https://github.com/advisories/GHSA-hj7v-p563-fffq

Compromised versions (1)

= 9.9.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.