mal-2026-15942
Vulnerability from ossf_malicious_packages
Published
2026-09-06 20:35
Modified
2026-09-08 19:16
Summary
Malicious code in omni-channel-order-frontend (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b5286224ab4427b1e85bbdfd5e57b9d96fc9736504d17f2f31839562f19b88ee)

The package name and 9999.0.0 version are consistent with a dependency-confusion lure targeting an internal omni-channel-order-frontend package. package.json declares a preinstall script (preinstall.js) that fires automatically on npm install. On execution it collects installer identifiers — os.hostname(), os.userInfo().username, current working directory, install path, process.platform/OS release, Node version, npm user-agent, and the resolved package name+version — and transmits them to hardcoded external destinations via three channels: a hex-encoded DNS-subdomain lookup to the Interactsh OAST collector dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online, an HTTPS POST to the same OAST host, and a plain-HTTP POST to the bare IP 5.189.159.252. Identifiers are hex-encoded into DNS labels so the fields still reach the attacker's authoritative resolver when HTTP egress is blocked. A swisscom-oce-* token embedded in the beacon tags the victim organization. Self-labeling in the source as an authorized bug-bounty PoC is author-controlled text and is inconsistent with a public-registry release using an implausibly high version number to win dependency resolution against an internal package.

Source: ossf-package-analysis (bc9f3bbbc24c8442e969e1bf5fa61f7ee879f0d25437f1e9e7b87df8bfd16a99)

The OpenSSF Package Analysis project identified 'omni-channel-order-frontend' @ 9999.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
CWE
  • CWE-506 - The product contains code that appears to be malicious in nature.
  • CWE-506 - The product contains code that appears to be malicious in nature.

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "preinstall.js",
              "sha256": "8f962a246826aaa6f7bd9db43ad0f13a51488058b451c82768f69913191ebfcb",
              "tlsh": "dd6194ae0daa50212272f7a4960f528dd6f3f1272506fa94b0ae82145fa443d137fcfd"
            }
          ],
          "package_integrity": [
            {
              "filename": "omni-channel-order-frontend-9999.0.0.tgz",
              "hashes": {
                "sha1": "a1db9f8e696384785112c3de3adcf300a3980d1b",
                "sha512_sri": "sha512-fJ9QhKy2gIOgRgnHQBxkhu1CkZPf2Utiivfe3b6qz+XsHORe5P05NigWZj6Kn2mvfM9E8+/MAcxvLUjzuYuZag=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "omni-channel-order-frontend"
      },
      "versions": [
        "0.0.1",
        "9999.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2026-09-06T20:37:51.415617775Z",
        "modified_time": "2026-09-06T20:35:52Z",
        "sha256": "8a1bbc397a5227aede0fbeacfc0039caf8f1b6bbb58ab76541cd76dbcbac2d00",
        "source": "ossf-package-analysis",
        "versions": [
          "0.0.1"
        ]
      },
      {
        "import_time": "2026-09-07T01:32:12.975732406Z",
        "modified_time": "2026-09-07T01:15:31Z",
        "sha256": "bc9f3bbbc24c8442e969e1bf5fa61f7ee879f0d25437f1e9e7b87df8bfd16a99",
        "source": "ossf-package-analysis",
        "versions": [
          "9999.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-019674",
        "import_time": "2026-09-08T19:15:03.943002112Z",
        "modified_time": "2026-09-08T19:07:20Z",
        "sha256": "b5286224ab4427b1e85bbdfd5e57b9d96fc9736504d17f2f31839562f19b88ee",
        "source": "amazon-inspector",
        "versions": [
          "9999.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-019672",
        "import_time": "2026-09-08T19:15:03.891688707Z",
        "modified_time": "2026-09-08T19:07:03Z",
        "sha256": "c190fa28104c72a2467b25e40898f26b853868b6a1181938ebab9635b0a4bb18",
        "source": "amazon-inspector",
        "versions": [
          "0.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b5286224ab4427b1e85bbdfd5e57b9d96fc9736504d17f2f31839562f19b88ee)\nThe package name and 9999.0.0 version are consistent with a dependency-confusion lure targeting an internal `omni-channel-order-frontend` package. `package.json` declares a `preinstall` script (`preinstall.js`) that fires automatically on `npm install`. On execution it collects installer identifiers \u2014 `os.hostname()`, `os.userInfo().username`, current working directory, install path, `process.platform`/OS release, Node version, npm user-agent, and the resolved package name+version \u2014 and transmits them to hardcoded external destinations via three channels: a hex-encoded DNS-subdomain lookup to the Interactsh OAST collector `dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online`, an HTTPS POST to the same OAST host, and a plain-HTTP POST to the bare IP `5.189.159.252`. Identifiers are hex-encoded into DNS labels so the fields still reach the attacker\u0027s authoritative resolver when HTTP egress is blocked. A `swisscom-oce-*` token embedded in the beacon tags the victim organization. Self-labeling in the source as an authorized bug-bounty PoC is author-controlled text and is inconsistent with a public-registry release using an implausibly high version number to win dependency resolution against an internal package.\n\n## Source: ossf-package-analysis (bc9f3bbbc24c8442e969e1bf5fa61f7ee879f0d25437f1e9e7b87df8bfd16a99)\nThe OpenSSF Package Analysis project identified \u0027omni-channel-order-frontend\u0027 @ 9999.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
  "id": "MAL-2026-15942",
  "modified": "2026-09-08T19:16:52.349813387Z",
  "published": "2026-09-06T20:35:52Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/omni-channel-order-frontend/v/9999.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/omni-channel-order-frontend/v/0.0.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in omni-channel-order-frontend (npm)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…