MAL-2026-15940 Malicious code in oce-configurator-wireless-frontend (npm)

Package name resembles an internal Swisscom OCE package and is published at version 9999.0.0 to win resolution against a private registry. The preinstall.js lifecycle script, which runs automatically on npm install, collects installer identifiers (os.hostname, os.userInfo().username, process.cwd, __dirname, package name/version, process.platform, node version, npm user-agent) and exfiltrates them to hardcoded external endpoints via three channels: (1) an HTTP/HTTPS POST to /beacon/<token> at the Interactsh collector dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online with a fallback from HTTPS to plain HTTP on error, (2) a plain-HTTP POST to the bare IP 5.189.159.252, and (3) a DNS side channel where each identifier is hex-encoded (Buffer.from(s).toString('hex').slice(0,60)) and concatenated as subdomain labels of the oast.online host, then resolved via dns.lookup. A hardcoded token 'swisscom-oce-3b9f1c7a2e' correlates the beaconed data with the targeted organization.

The OpenSSF Package Analysis project identified 'oce-configurator-wireless-frontend' @ 9999.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.