@tvg-mar/tvg-promos-atomic-ui@9.9.10

Summary

The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That file resolves the os and dns core modules indirectly through module.constructor._load with char-code-array names to avoid appearing in a normal require graph, then reads os.userInfo().username, os.hostname(), and the basename of process.cwd(). Those values are concatenated as DNS labels together with a hex-decoded destination domain and issued as a dns.resolve4 query to a subdomain of oob.algamil7x.xyz, a DNS-based out-of-band exfiltration collector. The destination hostname and the core-module names are stored as char-code arrays and decoded at runtime, and the logic is split across helper files (b2e6f8.js/c3f7a9.js) under a telemetry/probe cover directory. Every npm install of this version therefore leaks the installing user's username, machine hostname, and working-directory name to an attacker-controlled domain, and the obfuscation shows the destination and API surface were deliberately hidden.

Source: amazon-inspector (22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369)