Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

omni-channel-order-frontendnpm

Advisory published Updated

omni-channel-order-frontend is a confirmed malicious npm package (MAL-2026-15942) that steals credentials and exfiltrates sensitive data (malicious versions 0.0.1, 9999.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in omni-channel-order-frontend (npm)

MAL-2026-15942
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall omni-channel-order-frontend

What this malware does

The package name and 9999.0.0 version are consistent with a dependency-confusion lure targeting an internal omni-channel-order-frontend package. package.json declares a preinstall script (preinstall.js) that fires automatically on npm install. On execution it collects installer identifiers — os.hostname(), os.userInfo().username, current working directory, install path, process.platform/OS release, Node version, npm user-agent, and the resolved package name+version — and transmits them to hardcoded external destinations via three channels: a hex-encoded DNS-subdomain lookup to the Interactsh OAST collector dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online, an HTTPS POST to the same OAST host, and a plain-HTTP POST to the bare IP 5.189.159.252. Identifiers are hex-encoded into DNS labels so the fields still reach the attacker's authoritative resolver when HTTP egress is blocked. A swisscom-oce-* token embedded in the beacon tags the victim organization. Self-labeling in the source as an authorized bug-bounty PoC is author-controlled text and is inconsistent with a public-registry release using an implausibly high version number to win dependency resolution against an internal package.

The OpenSSF Package Analysis project identified 'omni-channel-order-frontend' @ 9999.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

Malicious versions

2 flagged
0.0.19999.0.0

Indicators of compromise (SHA-256)

8a1bbc397a5227aede0fbeacfc0039caf8f1b6bbb58ab76541cd76dbcbac2d00
bc9f3bbbc24c8442e969e1bf5fa61f7ee879f0d25437f1e9e7b87df8bfd16a99
b5286224ab4427b1e85bbdfd5e57b9d96fc9736504d17f2f31839562f19b88ee
c190fa28104c72a2467b25e40898f26b853868b6a1181938ebab9635b0a4bb18

Detection & response playbook

Credential / info stealer

  1. Find it

    Search your lockfiles and build artifacts for omni-channel-order-frontend (2 malicious versions).

  2. If you installed it — respond

    omni-channel-order-frontend is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If omni-channel-order-frontend was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. omni-channel-order-frontend on npm has been identified as a malicious package (versions 0.0.1, 9999.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019674IN-MAL-2026-019672

References

Credits

  • Amazon Inspector · finder
  • OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks omni-channel-order-frontend-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
omni-channel-order-frontend (npm) malicious package — MAL-2026-15942 | O3 Security