MAL-2026-15939 Malicious code in omni-channel-oid-frontend (npm)

omni-channel-oid-frontend ships a preinstall.js lifecycle script that fires automatically on npm install. The script collects os.hostname(), os.userInfo().username, cwd, install path, process.platform, Node version and the npm user-agent, and transmits the collected payload via a DNS lookup to an interactsh out-of-band collector at dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online and via HTTP(S) POST to that same host and to a bare-IP endpoint at 5.189.159.252. The package.json describes the package as a dependency-confusion proof-of-concept placeholder, but the shipped code performs the beacon on every install without installer consent, and the destinations are hardcoded third-party hosts rather than infrastructure the installer configured. Any build that resolves this name during install leaks installer-identifying data to those endpoints.

The OpenSSF Package Analysis project identified 'omni-channel-oid-frontend' @ 0.0.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.