{"items":[{"id":"NVI-00012187","kind":"supply_chain_event","title":"Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fvh3-76xv-7978"],"plain_summary":"GitHub lists this malware advisory for @tvg-mar/tvg-promos-atomic-ui. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-00c6698a1cf78b642eb1eef15be175fb"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-00c6698a1cf78b642eb1eef15be175fb","url":"https://github.com/advisories/GHSA-fvh3-76xv-7978","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fvh3-76xv-7978","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:59:24.535Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-00c6698a1cf78b642eb1eef15be175fb"],"technology":"@tvg-mar/tvg-promos-atomic-ui","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369)\nThe package's package.json declares an `install` lifecycle script that runs `node index.js`, which loads `runtime/support/telemetry/probe/impl.js`. That file resolves the `os` and `dns` core modules indirectly through `module.constructor._load` with char-code-array names to avoid appearing in a normal `require` graph, then reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`. Those values are concatenated as DNS labels together with a hex-decoded destination domain and issued as a `dns.resolve4` query to a subdomain of `oob.algamil7x.xyz`, a DNS-based out-of-band exfiltration collector. The destination hostname and the core-module names are stored as char-code arrays and decoded at runtime, and the logic is split across helper files (b2e6f8.js/c3f7a9.js) under a `telemetry/probe` cover directory. Every `npm install` of this version therefore leaks the installing user's username, machine hostname, and working-directory name to an attacker-controlled domain, and the obfuscation shows the destination and API surface were deliberately hidden.\n\n---\n\nCredit: [Ope","public_affected_ranges":["= 9.9.10"]}],"null_published_at":"2026-11-01T01:45:38.497Z","source_updated_at":"2026-09-23T00:31:22.000Z","source_disclosed_at":"2026-09-23T00:31:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:59:24.535Z"}],"next_cursor":null,"snapshot_revision":"42594"}