Malicious code in @opap/player-kyc-widget (npm)

---

__

Source: amazon-inspector (abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc)

The package's postinstall script runs automatically on npm install and collects host identifiers (hostname, username, cwd, platform, arch) from the installer, then transmits them off-host through two channels to a hardcoded Burp Collaborator subdomain k5qrs9i96xtw61nb3bbwwualqcw3kt8i.oastify.com: (1) an HTTPS GET carrying a base64-encoded payload in the query string, and (2) a DNS lookup where the fingerprint is hex-encoded and split into <=60-char labels prepended to the callback host, providing a covert channel that works even when outbound HTTP egress is blocked. The version number 3.999.999 published to the public @opap scope is the canonical shape of a dependency-confusion attack targeting a private internal scope of the same name.

Source: ghsa-malware (ebbe49c2623d54fed28386f226aefa5f14ccdf94caee07543ae5251beffd13fc)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Source: ossf-package-analysis (98e627cea85331a67652aa65927058579efe7046253a9ef22cb70b1d73916885)

The OpenSSF Package Analysis project identified '@opap/player-kyc-widget' @ 3.999.999 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.