@shared-web/utils

{"modified":"2026-09-18T20:25:56Z","published":"2026-09-18T20:25:56Z","schema_version":"1.7.4","id":"MAL-2026-16292","summary":"Malicious code in @shared-web/utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5425b12d827e5327939280ed16ddd0a613b28d0d728a0a8b193f342a666c65e9)\npackage.json declares scripts.install: node index.js, which loads lib/core.js. On npm install, that module reads os.userInfo().username, os.hostname(), and the current working directory basename, concatenates them with a fixed 'swutils' prefix and a timestamp using '.' as separators, and issues a dns.resolve4() query for the resulting label under a hardcoded out-of-band domain oob.algamil7x.xyz. The destination domain, the prefix, and the Node built-in module names ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd', 'resolve4', '_load') are stored as hex byte arrays in lib/a9b3de.js and lib/f8a2cd.js and reassembled at runtime via String.fromCharCode, with the runtime imported through module.constructor._load rather than a normal require. The library exposes no documented functionality that would motivate hiding its DNS destination or Node built-in module names. The result is a DNS-tunnel exfiltration of installer identity (username, host, cwd) to a non-first-party domain that fires automatically on every install.\n","affected":[{"package":{"ecosystem":"npm","name":"@shared-web/utils"},"versions":["9.9.10"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"e8db4e234f8aca0a53f56e9bde4aa9bd939d30fa32bae71ef6922650fda47395","tlsh":"3af02d69b393c48f97e096d1360a53d18859c2c0e7cf4195f7bc4a87904e7d1cac596a"},{"path":"lib/f8a2cd.js","sha256":"f7942b52b33a05f44ce43c1cc581fa1140cbbef03acdba961ade9f4a44cb03e1","tlsh":"73f0595166a3d19f77d69ac35f4190a0acb60a40b60ed0d5fa2c1bde00eeb13e9c54b0"}],"package_integrity":[{"filename":"utils-9.9.10.tgz","hashes":{"sha1":"b10d2340c3c76712deb370e44304acdacdba5b60","sha512_sri":"sha512-2G+TNP9wmKgx9pG5o9jlridw0kxtmz6vkY/H0VAfwsHFEluZiX94KzOLo9uFwdr/x/XrZFS+iDQTwSOzfnTqcg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@shared-web/utils/v/9.9.10"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020192","import_time":"2026-09-18T20:38:14.115437652Z","modified_time":"2026-09-18T20:25:56Z","sha256":"5425b12d827e5327939280ed16ddd0a613b28d0d728a0a8b193f342a666c65e9","source":"amazon-inspector","versions":["9.9.10"]}]}}