{"id":"MAL-2026-15939","summary":"Malicious code in omni-channel-oid-frontend (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cd8c0fe84f28408bb01adee4ff47b26ed354143c53975559c5d5f2b0a06a61ce)\nomni-channel-oid-frontend ships a preinstall.js lifecycle script that fires automatically on `npm install`. The script collects os.hostname(), os.userInfo().username, cwd, install path, process.platform, Node version and the npm user-agent, and transmits the collected payload via a DNS lookup to an interactsh out-of-band collector at dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online and via HTTP(S) POST to that same host and to a bare-IP endpoint at 5.189.159.252. The package.json describes the package as a dependency-confusion proof-of-concept placeholder, but the shipped code performs the beacon on every install without installer consent, and the destinations are hardcoded third-party hosts rather than infrastructure the installer configured. Any build that resolves this name during install leaks installer-identifying data to those endpoints.\n\n## Source: ossf-package-analysis (06097afe7563cc6796cab5df983af5bf185bb72846d998851a38cfebfc811968)\nThe OpenSSF Package Analysis project identified 'omni-channel-oid-frontend' @ 0.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-09-09T02:00:04.632507985Z","published":"2026-09-06T20:15:51Z","database_specific":{"malicious-packages-origins":[{"versions":["0.0.1"],"import_time":"2026-09-06T20:16:29.765723493Z","modified_time":"2026-09-06T20:15:51Z","sha256":"06097afe7563cc6796cab5df983af5bf185bb72846d998851a38cfebfc811968","source":"ossf-package-analysis"},{"sha256":"4090da08218ff50b18e683a77dac118b671bdaf0983984b1f2442e013f3f23e3","source":"amazon-inspector","versions":["9999.0.0"],"id":"IN-MAL-2026-019671","import_time":"2026-09-08T19:15:03.824172689Z","modified_time":"2026-09-08T19:06:55Z"},{"source":"amazon-inspector","versions":["0.0.1"],"id":"IN-MAL-2026-019739","import_time":"2026-09-09T01:51:47.945265775Z","modified_time":"2026-09-09T01:33:25Z","sha256":"cd8c0fe84f28408bb01adee4ff47b26ed354143c53975559c5d5f2b0a06a61ce"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/omni-channel-oid-frontend/v/9999.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/omni-channel-oid-frontend/v/0.0.1"}],"affected":[{"package":{"name":"omni-channel-oid-frontend","ecosystem":"npm","purl":"pkg:npm/omni-channel-oid-frontend"},"versions":["0.0.1","9999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/omni-channel-oid-frontend/MAL-2026-15939.json","indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"8f962a246826aaa6f7bd9db43ad0f13a51488058b451c82768f69913191ebfcb","tlsh":"dd6194ae0daa50212272f7a4960f528dd6f3f1272506fa94b0ae82145fa443d137fcfd"}],"package_integrity":[{"filename":"omni-channel-oid-frontend-9999.0.0.tgz","hashes":{"sha512_sri":"sha512-3BuqzfsPWSIr8Lk1Ar15FrXcIWnIDtFgHv/N8yn2mnJttJw8fe0jWhIqbJp8zC0FlG2VWAdfqhT6lJvtIEBkzw==","sha1":"d7bfe9ebe53f6fab818f3f4be8c9a5b101112242"}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}