Malicious code in @tvg-mar/promos-gtm (npm)

{
  "id": "0bbcbc6a0eb382235b28bdbb27a72cfcdcb4384fd046a0f3148ef0a0c4216d4d",
  "url": "https://osv.dev/vulnerability/MAL-2026-16413",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in @tvg-mar/promos-gtm (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28) @tvg-mar/promos-gtm@9.9.10 executes an out-of-band DNS exfiltration routine both at install time (via a scripts.install hook running node index.js) and on require() (top-level module load chain reaching runtime/support/telemetry/probe/impl.js). The probe reads os.userInfo().username, os.hostname(), and process.cwd(), concatenates them with a timestamp and a prefix tag, and issues dns.resolve4 against a subdomain of a hardcoded attacker-controlled domain. The destination suffix (oob.algamil7x.xyz), prefix tag (tvggtm), Node built-in names (os, dns, process, userInfo, hostname, cwd, resolve4), and the internal _load API are stored as hex character-code arrays and reassembled at runtime via String.fromCharCode; the os and dns modules are loaded indirectly through module.constructor._load to further hide the behavior. The DNS channel bypasses typical HTTP egress controls and delivers installer host identifiers to attacker infrastructure with no relation to the package's advertised purpose. ## Source: ghsa-malware (95dd5b801710e7f59a680d1648fb22f659f490839abb1f2f798884fe75df63f9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of t",
    "evidence": "osv:MAL-2026-16413",
    "products": [
      {
        "name": {
          "value": "@tvg-mar/promos-gtm",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "9.9.10",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-16413",
      "aliases": [
        "GHSA-8g69-976g-h44g",
        "MAL-2026-16413"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "@tvg-mar/promos-gtm",
            "purl": "pkg:npm/%40tvg-mar/promos-gtm",
            "ecosystem": "npm"
          },
          "versions": [
            "9.9.10"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tvg-mar/promos-gtm/MAL-2026-16413.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "runtime/support/telemetry/probe/impl.js",
                  "tlsh": "d9119c5af253d08f27c04a99391c53e1482d82d087dd50d1bb7c178ba2cd7918ad3e66",
                  "sha256": "82db6ba80708c969d705d9c37f9ede060e94d314deb5b39805b4751553349be5"
                },
                {
                  "path": "runtime/support/telemetry/probe/a9d1f4.js",
                  "tlsh": "34e0d82a219be14fa6d85aa73b16c5dac8420900e11d4ad9fa1d0687206e05681c0771",
                  "sha256": "76103a448aaea3faa95bc52ae97b65e2d3e661b61073b9e2d6ae5b334aacf68f"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "76de3c3b7123b42311cc42839e406d8ce36173ba",
                    "sha512_sri": "sha512-PPxuK5AIxTXTw7rb6l+Bh0HlBxNdNfixaCccCQGiZmNMweqQHj0QhXMdqItR7gbvt5mhTsrGSMfwh4c7wRB1tA=="
                  },
                  "filename": "promos-gtm-9.9.10.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-09T15:33:30.158434949Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/@tvg-mar/promos-gtm/v/9.9.10",
        "https://github.com/advisories/GHSA-8g69-976g-h44g"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-020307",
            "sha256": "0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28",
            "source": "amazon-inspector",
            "versions": [
              "9.9.10"
            ],
            "import_time": "2026-09-22T22:16:11.021718511Z",
            "modified_time": "2026-09-22T21:50:39Z"
          },
          {
            "id": "GHSA-8g69-976g-h44g",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "95dd5b801710e7f59a680d1648fb22f659f490839abb1f2f798884fe75df63f9",
            "source": "ghsa-malware",
            "import_time": "2026-10-09T15:26:20.355862519Z",
            "modified_time": "2026-10-09T15:17:14Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 121075,
  "published_at": "2026-09-22T21:50:39+00:00"
}