MalwarePublished 21 Sep 2026Updated 24 Sep 2026

@insiderintelligence/componentlibrary (npm) · Malicious Code

Affects @insiderintelligence/componentlibrarySource GCVE Database

Malicious package : remove @insiderintelligence/componentlibrary and rotate any secrets on hosts that installed it.

Data as of 24 Sep 2026, 06:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16353

What to do

Remove @insiderintelligence/componentlibrary from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@insiderintelligence/componentlibrary	Affected =9.9.10	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @insiderintelligence/componentlibrary version 9.9.10 contains malicious code that executes automatically upon installation and import. It collects system information such as username, hostname, and current directory, then exfiltrates this data via DNS queries to an external domain. This behavior is disguised as a connectivity probe and is unrelated to the package's stated purpose. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.

Impact

Any system with this package installed or running is considered fully compromised. The attacker may have gained control over the host, and all secrets, credentials, and keys stored on the system should be assumed exposed and rotated immediately. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Defensive guidance

Immediate removal of the @insiderintelligence/componentlibrary package version 9.9.10 is recommended. All secrets and keys stored on the compromised system should be rotated from a secure, uncompromised environment. Due to the potential full compromise, a thorough incident response and system rebuild may be necessary.

Summary

The @insiderintelligence/componentlibrary npm package version 9.9.10 includes a malicious script that runs automatically during npm install and when the package is required. The script loads a module that gathers sensitive system information (os.userInfo().username, os.hostname(), current working directory leaf) and encodes this data into a DNS query sent to oob.algamil7x.xyz, bypassing HTTP egress controls. The malicious code is obfuscated using String.fromCharCode arrays and dynamic module loading to disguise its true purpose as a connectivity probe. This exfiltration occurs without user consent and is unrelated to the package's declared functionality as a component library.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 24 Sep 2026, 06:15 UTC

Technical details

References

Community reviews