Koishi Chatbots Compromised by Malicious npm Package to Steal Sensitive Data in Real Time

A recent discovery by Socket’s Threat Research Team has sent shockwaves across the chatbot development community.

The team uncovered a malicious npm package, koishi-plugin-pinhaofa, that stealthily implants a data-exfiltration backdoor into Koishi chatbots.

Marketed deceptively as a spelling-autocorrect helper, this plugin covertly scans every message handled by a chatbot for an eight-character hexadecimal string.

Upon detecting such a string which could represent truncated hashes, partial API tokens, or sensitive IDs the plugin immediately forwards the entire content of the intercepted message to a hardcoded QQ account, effectively compromising potentially sensitive data in real time.

Supply Chain Threat Targets Chatbot Ecosystem

The Koishi chatbot framework is widely employed across industries for its cross-platform capability, enabling bot deployment on platforms like QQ, Telegram, and Discord from a unified TypeScript codebase.

Koishi’s thriving plugin marketplace, which boasts over a thousand community-contributed modules, is engineered for extensibility.

However, its architecture allowing plugins to run directly within the bot process also exposes it to significant supply chain risks.

The plugin in question, koishi-plugin-pinhaofa, published under the npm alias “kuminfennel” and associated with the QQ account 1821181277, leverages these very extensibility features to carry out its attack.

At the code level, the plugin attaches to Koishi’s message event stream, using a regular expression to search for eight-character hexadecimal values in every incoming message.

These values often correspond to short Git commit hashes, JWT or API token fragments, CRC-32 checksums, or other identifiers that, if exfiltrated, can unlock access to broader internal systems or expose private assets.

When a matching string is found, the plugin forwards the entire message, including any secrets, credentials, or URLs, to the attacker’s QQ inbox by leveraging the bot’s built-in private messaging functions.

According to the Socket Report, this method keeps exfiltration hidden within normal chat traffic, evading most conventional detection mechanisms.

Real-Time Data Exfiltration via Malicious Plugin

The impact of such a compromise is potentially severe, especially in sectors where chatbots handle sensitive exchanges.

Banking assistants may inadvertently leak portions of payment card numbers or transaction hashes.

E-commerce chatbots might reveal order status links with embedded tokens or customer addresses.

In healthcare, patient codes or appointment IDs could be exposed without the knowledge of users or administrators.

Since plugins are often installed without rigorous security reviews, the backdoor could be widely propagated in production environments.

The package, associated with the email address 1821181277@qq[.]com, remains available on both npm and GitHub at the time of reporting.

Security researchers have petitioned for its removal, but the incident highlights the urgent need for improved security hygiene in chatbot environments.

Experts recommend that organizations containerize bots and restrict their communication to approved domains or user IDs, minimizing the blast radius if a plugin is compromised.

Furthermore, integrated security tooling, such as the Socket GitHub app and CLI, can identify malicious code patterns and flag risky dependencies during development and deployment.

This incident is indicative of an escalating trend in supply chain attacks against conversational AI and chatbot frameworks, particularly as adoption rates surge in finance, retail, and healthcare sectors.

Developers and bot administrators are urged to enforce strict code reviews, leverage automated security analysis, and monitor for indicators of compromise in their chatbot ecosystems.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates