MAL-2026-15942

Dashboard / Malicious Package / MAL-2026-15942

MAL-2026-15942

Summary: Malicious code in omni-channel-order-frontend (npm)

Details: Source: amazon-inspector (b5286224ab4427b1e85bbdfd5e57b9d96fc9736504d17f2f31839562f19b88ee) The package name and 9999.0.0 version are consistent with a dependency-confusion lure targeting an internal `omni-channel-order-frontend` package. `package.json` declares a `preinstall` script (`preinstall.js`) that fires automatically on `npm install`. On execution it collects installer identifiers — `os.hostname()`, `os.userInfo().username`, current working directory, install path, `process.platform`/OS release, Node version, npm user-agent, and the resolved package name+version — and transmits them to hardcoded external destinations via three channels: a hex-encoded DNS-subdomain lookup to the Interactsh OAST collector `dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online`, an HTTPS POST to the same OAST host, and a plain-HTTP POST to the bare IP `5.189.159.252`. Identifiers are hex-encoded into DNS labels so the fields still reach the attacker's authoritative resolver when HTTP egress is blocked. A `swisscom-oce-*` token embedded in the beacon tags the victim organization. Self-labeling in the source as an authorized bug-bounty PoC is author-controlled text and is inconsistent with a public-registry release using an implausibly high version number to win dependency resolution against an internal package. Source: ossf-package-analysis (bc9f3bbbc24c8442e969e1bf5fa61f7ee879f0d25437f1e9e7b87df8bfd16a99) The OpenSSF Package Analysis project identified 'omni-channel-order-frontend' @ 9999.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References: https://www.npmjs.com/package/omni-channel-order-frontend/v/9999.0.0, https://www.npmjs.com/package/omni-channel-order-frontend/v/0.0.1