oauth-connect

GHSA-35fj-cp92-rv2m

Malicious code in oauth-connect (npm)

Details

**Severity:** Critical

**Affected versions:** `= 2.0.1`

## Source: amazon-inspector (b49c48193ba50bb4ead1e212925eab8873e7e4ad7fa834d41e7626bb4e5036f3)
package.json declares a `preinstall: node index.js` hook that fires automatically on `npm install`. index.js collects installer-side data — `os.hostname()`, `os.userInfo()`, home directory, DNS server configuration, the contents of `/etc/passwd` and `/etc/hosts`, and the contents of the consumer's `package.json` — then HTTPS POSTs the assembled JSON to `f3js0y9srl22itqjffo9jbl8mzswgm4b.oastify.com`, an attacker-controlled Burp Collaborator subdomain. The package's advertised purpose (an OAuth helper) bears no relationship to reading `/etc/passwd` or beaconing host identifiers off-machine. This is a reconnaissance / dependency-confusion exfiltration payload that runs unattended on every installer.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/69ce1ab0d67ec6170adf5c3f9fba790ede81f48f/osv/malicious/npm/oauth-connect/MAL-2024-2779.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/69ce1ab0d67ec6170adf5c3f9fba790ede81f48f/osv/malicious/npm/oauth-connect/MAL-2024-2779.json
- https://www.npmjs.com/package/oauth-connect/v/0.1.1
- https://github.com/advisories/GHSA-35fj-cp92-rv2m

Compromised versions (1)

= 2.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.