@tvg-mar/promos-gtm@9.9.10

Analysis

The package's install hook runs a hidden telemetry probe that collects the installing machine's OS username, hostname, and current working directory, then exfiltrates them to the attacker-controlled domain oob[.]algamil7x[.]xyz via a DNS query of the form tvggtm.<username>.<hostname>.<cwd>.<timestamp>.oob[.]algamil7x[.]xyz. The values are obfuscated with charcode-array decoding and disguised as registry-connectivity diagnostics. The package is presented as a GTM/tracking integration library but performs this covert host-metadata beacon on every install.