MAL-2026-15939

    Dashboard / Malicious Package / MAL-2026-15939

    MAL-2026-15939

    Published: 6 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in omni-channel-oid-frontend (npm)

    Details: Source: amazon-inspector (cd8c0fe84f28408bb01adee4ff47b26ed354143c53975559c5d5f2b0a06a61ce) omni-channel-oid-frontend ships a preinstall.js lifecycle script that fires automatically on `npm install`. The script collects os.hostname(), os.userInfo().username, cwd, install path, process.platform, Node version and the npm user-agent, and transmits the collected payload via a DNS lookup to an interactsh out-of-band collector at dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online and via HTTP(S) POST to that same host and to a bare-IP endpoint at 5.189.159.252. The package.json describes the package as a dependency-confusion proof-of-concept placeholder, but the shipped code performs the beacon on every install without installer consent, and the destinations are hardcoded third-party hosts rather than infrastructure the installer configured. Any build that resolves this name during install leaks installer-identifying data to those endpoints. Source: ossf-package-analysis (06097afe7563cc6796cab5df983af5bf185bb72846d998851a38cfebfc811968) The OpenSSF Package Analysis project identified 'omni-channel-oid-frontend' @ 0.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://www.npmjs.com/package/omni-channel-oid-frontend/v/9999.0.0, https://www.npmjs.com/package/omni-channel-oid-frontend/v/0.0.1

    Affected packages

    Package

    Name: omni-channel-oid-frontend

    Purl: pkg:npm/omni-channel-oid-frontend

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1
    MAL-2026-15939 | CVE-DB