Malicious code in @insiderintelligence/componentlibrary (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a4451c41559202c6bce3218de9af47cabe20288af5f3a9240076f25b3b2b5993) The package declares scripts.install: node index.js, so npm install auto-executes index.js which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo().username, os.hostname(), and the current working directory's leaf name, joins them with a fixed prefix (iiclib) and a timestamp into a subdomain label, and issues a dns.resolve4() query against oob.algamil7x.xyz — exfiltrating installer identity via a DNS side-channel that bypasses HTTP egress controls. The destination host, the module names ('os','dns','process'), and the resolved API names ('userInfo','hostname','cwd','resolve4','_load') are hidden behind String.fromCharCode arrays in sibling helpers a8e4c9.js and f7d3b8.js, and the module is loaded via module.constructor._load through encoded literals to disguise the primitive as a 'connectivity probe'. The same path also runs on require() because index.js is the package main. The behavior has no connection to the package's stated component-library purpose. ## Source: ghsa-malware (1dd58e4d232be3112ad684139fd2755dc99e336a8960c2d1cee2c83b91a33825) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the
MAL-2026-16353
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-16353
@insiderintelligence/componentlibrary
Source reference: /affected/0/package/name
- Affected versions
- 9.9.10
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@insiderintelligence/componentlibrary",
"purl": "pkg:npm/%40insiderintelligence/componentlibrary",
"ecosystem": "npm"
},
"versions": [
"9.9.10"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@insiderintelligence/componentlibrary/MAL-2026-16353.json",
"indicators": {
"evidence_files": [
{
"path": "runtime/support/telemetry/probe/impl.js",
"tlsh": "02119c5ab253d08f23d04699391c43e1482d82d087dd51d1bb7c178ba2cd7908ad3aa6",
"sha256": "193fd98a2ce3086b746b4f1bdee26f264cbc3af039b679c01f628a4da8b27894"
},
{
"path": "runtime/support/telemetry/probe/a8e4c9.js",
"tlsh": "37e0201b21efe14fa69c5ea71f17d4dbc8c70d00a21c4ad9f90d168710aa016c0c0770",
"sha256": "e7d5a508a321634f66d4e86e39b38f1d8c61e56bc3b6a6513931abbb6dcd463a"
},
{
"path": "package.json",
"tlsh": "4e1176754ba604632be42649ebb82c0eb2621c4b859a6c442bf7482086cf03641be3fd",
"sha256": "1481d3bd55b35ce71f9cc34bc627616dbe1e15965b05f1b2ac20c5be9e4db759"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "c323f4ce3cab40d863fe8855ba1a3e0d9f0fe5ce",
"sha512_sri": "sha512-KoqLjVvmPOJAvFQAuOpqMQRxUeTa+VK/8L/qVsHLopst3mVnfCFsWkaxturrwRt5TfB57g9A6bIDhKOzMzIAcA=="
},
"filename": "componentlibrary-9.9.10.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #5764 · Revision 1
- Added to Heist Feed
- Publisher date