Supply chain · npm · High

Malicious npm package @oyo_tech/oyochat_user identified in supply chain

Threat Engine Auto-Feed · data current as of 2026-08-18

A critical severity malicious package, `@oyo_tech/oyochat_user` version 100.0.0, has been identified in the npm ecosystem. This package communicates with a domain associated with malicious activity, posing a supply chain risk to any projects that have integrated it.

  • Package: npm / @oyo_tech/oyochat_user
  • Affected versions: = 100.0.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The npm package `@oyo_tech/oyochat_user` version 100.0.0 was identified as malicious by the OpenSSF Package Analysis project. The package was flagged because it communicates with a domain known to be associated with malicious activity.

How the attack works

This is a malicious package attack where an attacker publishes a seemingly legitimate software component containing hidden malicious code. When developers integrate this package into their projects, the malicious code executes within their build environment or deployed applications, potentially establishing unauthorized network communication.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Projects that have `@oyo_tech/oyochat_user` version 100.0.0 as a direct or transitive dependency

Conditions that increase exposure

  • Unpinned dependency versions in package.json or similar manifest files
  • Lack of dependency lockfiles (e.g., package-lock.json, yarn.lock)
  • Use of internal package mirrors that do not vet upstream packages
  • Automated builds that do not perform static or dynamic analysis on new dependencies

Blast-radius scenarios

  • If installed, the package initiates unauthorized communication with a malicious domain. This could lead to data exfiltration, command and control, or further compromise of the build environment or runtime system. The blast radius extends to any system where the affected application is built or deployed.

What to do (defensive)

Detect

  • Scan dependency trees for `@oyo_tech/oyochat_user` version 100.0.0 using software composition analysis (SCA) tools.
  • Monitor network traffic from build environments and deployed applications for connections to suspicious or unknown domains.
  • Review package lockfiles to ensure no malicious versions are present.

Contain

  • Immediately quarantine any systems or environments found to be running or building with the affected package.
  • Block network communication to the malicious domain identified by the package.
  • Revoke any credentials or tokens that may have been exposed in compromised build environments.

Remediate

  • Remove `@oyo_tech/oyochat_user` version 100.0.0 from all project dependencies.
  • Update all dependencies to known good, non-malicious versions, preferably pinning them to specific, audited versions.
  • Rebuild affected applications from a clean state with verified dependencies.
  • Conduct a thorough forensic analysis of any systems where the malicious package was installed or executed to identify potential further compromise.

Frontier verdict — High

Prioritize immediate detection and removal of `@oyo_tech/oyochat_user` version 100.0.0 due to its critical severity and malicious network activity.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.