If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (cd8c0fe84f28408bb01adee4ff47b26ed354143c53975559c5d5f2b0a06a61ce)
omni-channel-oid-frontend ships a preinstall.js lifecycle script that fires automatically on `npm install`. The script collects os.hostname(), os.userInfo().username, cwd, install path, process.platform, Node version and the npm user-agent, and transmits the collected payload via a DNS lookup to an interactsh out-of-band collector at dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online and via HTTP(S) POST to that same host and to a bare-IP endpoint at 5.189.159.252. The package.json describes the package as a dependency-confusion proof-of-concept placeholder, but the shipped code performs the beacon on every install without installer consent, and the destinations are hardcoded third-party hosts rather than infrastructure the installer configured. Any build that resolves this name during install leaks installer-identifying data to those endpoints.
Source: ossf-package-analysis (06097afe7563cc6796cab5df983af5bf185bb72846d998851a38cfebfc811968)
The OpenSSF Package Analysis project identified 'omni-channel-oid-frontend' @ 0.0.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.