oauth-connect

{"schema_version":"1.7.4","id":"MAL-2024-2779","published":"2024-06-25T12:53:40Z","modified":"2026-09-01T11:20:28.716684334Z","aliases":["GHSA-35fj-cp92-rv2m"],"summary":"Malicious code in oauth-connect (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b49c48193ba50bb4ead1e212925eab8873e7e4ad7fa834d41e7626bb4e5036f3)\npackage.json declares a `preinstall: node index.js` hook that fires automatically on `npm install`. index.js collects installer-side data — `os.hostname()`, `os.userInfo()`, home directory, DNS server configuration, the contents of `/etc/passwd` and `/etc/hosts`, and the contents of the consumer's `package.json` — then HTTPS POSTs the assembled JSON to `f3js0y9srl22itqjffo9jbl8mzswgm4b.oastify.com`, an attacker-controlled Burp Collaborator subdomain. The package's advertised purpose (an OAuth helper) bears no relationship to reading `/etc/passwd` or beaconing host identifiers off-machine. This is a reconnaissance / dependency-confusion exfiltration payload that runs unattended on every installer.\n","affected":[{"package":{"name":"oauth-connect","ecosystem":"npm","purl":"pkg:npm/oauth-connect"},"versions":["2.0.1","0.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"b98e6327b15b5885a437db2baa282eb78a85ff62c75a6a91dde7160ddd21ebb7","tlsh":"3c411395a2c917330dd210c06a0c70812359fa767259a9d076cf42969f869f8b7326f3"}],"package_integrity":[{"filename":"oauth-connect-0.1.1.tgz","hashes":{"sha1":"c723bfe3fe202419a53e270b6f97007d59592ae4","sha512_sri":"sha512-VrJwoZPHzVKjz7CxEzkTDDSmYA0Z7GP+hh/vSTp648nBdkrarpTret3TgkTTKVLbqKOl78zYb4ltmcDuo71i7g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/oauth-connect/v/0.1.1"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-35fj-cp92-rv2m"}],"database_specific":{"malicious-packages-origins":[{"id":"RLMA-2024-01484","import_time":"2024-06-28T02:44:12.934484377Z","modified_time":"2024-06-25T12:53:40Z","sha256":"58cdf77b0ce849d87a73b7b742c549d96a0e74a5083bbd5e7052cec96dcd6f75","source":"reversing-labs","versions":["2.0.1"]},{"id":"RLUA-2024-07004","import_time":"2024-10-24T00:58:08.729509642Z","modified_time":"2024-10-16T13:08:36Z","sha256":"e9e13b3242147d53e64ad60318a7ab4e3dcf782f750149928912d60a5b8961cf","source":"reversing-labs"},{"id":"IN-MAL-2026-007390","import_time":"2026-06-23T22:31:28.726727113Z","modified_time":"2026-06-23T22:25:41Z","sha256":"b49c48193ba50bb4ead1e212925eab8873e7e4ad7fa834d41e7626bb4e5036f3","source":"amazon-inspector","versions":["0.1.1"]},{"id":"RLUA-2026-05585","import_time":"2026-07-20T13:15:03.086177733Z","modified_time":"2026-07-20T10:52:23Z","sha256":"06384ea9bbb8128ba9a56ef7829db094ca9626204e20eb4fb09ae5bfb3d6cbba","source":"reversing-labs","versions":["0.1.1"]},{"id":"RLUA-2026-06353","import_time":"2026-09-01T11:18:13.83407934Z","modified_time":"2026-08-24T17:02:00Z","sha256":"8b85cd9a80881f9255a618e8f12b0d8a257ad3bf9a963d8a8b7b3a0576339852","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}