@shared-web/assets

GHSA-vmr9-5w3x-4v98

Malicious code in @shared-web/assets (npm)

Details

**Severity:** Critical

**Affected versions:** `= 9.9.10`

## Source: amazon-inspector (e8fd9342e97dc9f655a994fe1091125f717cbfa7b89aa6a2333662ad23ad6771)
The package runs an install lifecycle script (`node index.js`) and also executes `./lib/core.js` on require. That code collects `os.userInfo().username`, `os.hostname()`, and `process.cwd()` and issues a DNS `resolve4` for a label chain of the form `<pkg>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz`, exfiltrating installer identity and working-directory information over DNS to an attacker-controlled domain. The destination host and the `os`/`dns`/`process` module names are obfuscated in `lib/c5df9a.js` and `lib/b4ce8f.js` using char-code byte arrays (`String.fromCharCode`) and loaded via `module.constructor._load` instead of plain `require`, concealing both the APIs and the C2 destination. The obfuscation and DNS-label-encoded channel are inconsistent with the package's presentation as a shared web assets helper.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/3f18b05ad8d8f2ae5dbf359a6c5fd7297d9d5529/osv/malicious/npm/@shared-web/assets/MAL-2026-16283.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/3f18b05ad8d8f2ae5dbf359a6c5fd7297d9d5529/osv/malicious/npm/@shared-web/assets/MAL-2026-16283.json
- https://www.npmjs.com/package/@shared-web/assets/v/9.9.10
- https://github.com/advisories/GHSA-vmr9-5w3x-4v98

Compromised versions (1)

= 9.9.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.