MAL-2024-2779

    Dashboard / Malicious Package / MAL-2024-2779

    MAL-2024-2779

    Published: 25 Jun 2024Last Modified: 1 Sept 2026Aliases: 
    GHSA-35fj-cp92-rv2m

    Summary: Malicious code in oauth-connect (npm)

    Details: Source: amazon-inspector (b49c48193ba50bb4ead1e212925eab8873e7e4ad7fa834d41e7626bb4e5036f3) package.json declares a `preinstall: node index.js` hook that fires automatically on `npm install`. index.js collects installer-side data — `os.hostname()`, `os.userInfo()`, home directory, DNS server configuration, the contents of `/etc/passwd` and `/etc/hosts`, and the contents of the consumer's `package.json` — then HTTPS POSTs the assembled JSON to `f3js0y9srl22itqjffo9jbl8mzswgm4b.oastify.com`, an attacker-controlled Burp Collaborator subdomain. The package's advertised purpose (an OAuth helper) bears no relationship to reading `/etc/passwd` or beaconing host identifiers off-machine. This is a reconnaissance / dependency-confusion exfiltration payload that runs unattended on every installer.

    References: https://www.npmjs.com/package/oauth-connect/v/0.1.1, https://github.com/advisories/GHSA-35fj-cp92-rv2m

    Affected packages

    Package

    Name: oauth-connect

    Purl: pkg:npm/oauth-connect

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.1
    MAL-2024-2779 | CVE-DB