omni-channel-oid-frontend@9999.0.0

Summary

preinstall.js runs automatically on npm install and transmits a JSON body containing hostname, OS username, current working directory, install path, platform, Node version, and npm user-agent to two hardcoded destinations: an interactsh-style out-of-band collector at dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online and a bare IP 5.189.159.252 over plain HTTP. The same identifiers are additionally exfiltrated over a covert DNS channel by encoding token, package name, hostname, and username into hex labels under the OOB domain and issuing dns.lookup against the assembled name, bypassing HTTP egress filtering. The package name resembles an internal-sounding scope and is pinned at version 9999.0.0, consistent with a dependency-confusion payload designed to win resolution against a private package of the same name.

Source: amazon-inspector (4090da08218ff50b18e683a77dac118b671bdaf0983984b1f2442e013f3f23e3)