Malicious code in @tesla-insurance/vinless-quote (npm)

{
  "id": "d1cbe507c78a41e64f2a1053d66b125fb2393f99ae5ac8fe8c8e9fd9bcac9080",
  "url": "https://osv.dev/vulnerability/MAL-2026-16378",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in @tesla-insurance/vinless-quote (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730) The package declares an `install` lifecycle script (`node index.js`) that loads `runtime/support/telemetry/probe/impl.js`. On `npm install`, this probe collects the OS username (`os.userInfo().username`), hostname (`os.hostname()`), and the basename of the current working directory, joins them with a static prefix into a DNS label, and issues `dns.resolve4()` against a subdomain of `oob.algamil7x.xyz` — a covert DNS-based exfiltration channel that bypasses HTTP egress filtering. Both the destination host and the module names (`os`, `dns`, `process`) are obfuscated as `String.fromCharCode` byte arrays, and modules are loaded via `module.constructor._load` rather than plain `require`, hiding the hostile endpoint and the primitives used to reach it. The package is published under a vendor-branded scope (`@tesla-insurance/vinless-quote`) unrelated to the attacker domain, consistent with a social-engineering wrapper around the exfiltration payload. ## Source: ghsa-malware (177675920d7326f3ba010b417c3fc22f275eda24d7593e2c6167fc1ff1874715) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsi",
    "evidence": "osv:MAL-2026-16378",
    "products": [
      {
        "name": {
          "value": "@tesla-insurance/vinless-quote",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "9.9.10",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-16378",
      "aliases": [
        "GHSA-6m9v-pw95-fc67",
        "MAL-2026-16378"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "@tesla-insurance/vinless-quote",
            "purl": "pkg:npm/%40tesla-insurance/vinless-quote",
            "ecosystem": "npm"
          },
          "versions": [
            "9.9.10"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tesla-insurance/vinless-quote/MAL-2026-16378.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "runtime/support/telemetry/probe/impl.js",
                  "tlsh": "a6119c5ab353d08f23c04699391c53e1882e82d097dd50d1bb7c169ba2cd7914ad3aa6",
                  "sha256": "a5973b004a66466c59213d45510643ad64f0f751d542d9f8ee289ddd4080e326"
                },
                {
                  "path": "runtime/support/telemetry/probe/a3b9d5.js",
                  "tlsh": "9ce0202b11dff14fa6dc5eab2f17c4dac8820900e21d4ad9f90d178b206a016d1c0771",
                  "sha256": "aee8240b3d83961c1a0e3c35b35faa68bf199ddb2120a676f251c86202a19425"
                },
                {
                  "path": "package.json",
                  "tlsh": "d8118c550733cc131ee0be42ea931a03736369168a46adc942eb442297cda3730fe67d",
                  "sha256": "896b702ed9b4931bc518075964c1a72e30ece345e9ede6041adb3997b95b95c7"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "450e80159990a78199a8c5d3652248911e1c9276",
                    "sha512_sri": "sha512-jkJJNWJB+1E1atb+SOay1MODtGWzIYoeg5fMJVSzv7AmK4roTTSqZRPrKnspwmJjrrZK6SjApiE+dRSI6AzbFw=="
                  },
                  "filename": "vinless-quote-9.9.10.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-12T13:45:04.790727552Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/@tesla-insurance/vinless-quote/v/9.9.10",
        "https://github.com/advisories/GHSA-6m9v-pw95-fc67"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-020287",
            "sha256": "4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730",
            "source": "amazon-inspector",
            "versions": [
              "9.9.10"
            ],
            "import_time": "2026-09-22T14:19:07.778563567Z",
            "modified_time": "2026-09-22T13:58:00Z"
          },
          {
            "id": "GHSA-6m9v-pw95-fc67",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "177675920d7326f3ba010b417c3fc22f275eda24d7593e2c6167fc1ff1874715",
            "source": "ghsa-malware",
            "import_time": "2026-10-12T12:55:43.297290393Z",
            "modified_time": "2026-10-12T12:52:54Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 299928,
  "published_at": "2026-09-22T13:58:00+00:00"
}