@shared-runtime/[email protected] executes code that gathers sensitive environment information including os.userInfo().username, os.hostname(), and the basename of the current working directory. This data is exfiltrated through DNS resolution queries to a subdomain constructed dynamically and sent to oob.algamil7x.xyz, controlled by the attacker. The code uses obfuscation techniques by storing strings as hex byte arrays and reconstructing them at runtime, and loads the os and dns modules via indirect means to evade static detection. The malicious code runs both at install time (via package.json install script) and at runtime when the module is required, with errors caught and suppressed to ensure npm install reports success. The README falsely claims no network calls occur in module scope, contradicting the actual behavior.

Sensitive environment information such as the OS username, hostname, and current working directory is leaked to an attacker-controlled domain. This can lead to privacy violations and may aid attackers in further reconnaissance or targeted attacks. The malicious code executes silently during installation and runtime, increasing the risk of unnoticed data exfiltration.

No official patch or remediation is currently documented. Users should avoid installing or using @shared-runtime/modules version 9.9.10. Review and remove this package if present in your environment. Monitor for suspicious DNS queries to unknown domains such as oob.algamil7x.xyz. Check vendor advisories or npm security advisories for updates or patches.