Malicious npm Package in Koishi Chatbots Steals Sensitive Data in Real Time

Socket’s Threat Research Team has uncovered a dangerous npm package named koishi-plugin-pinhaofa, masquerading as a spelling-autocorrect helper for Koishi chatbots.

Marketed innocently, this plugin embeds a insidious data-exfiltration backdoor that scans every incoming message for an eight-character hexadecimal string a common format for Git commit hashes, truncated JWT tokens, API keys, or device IDs.

Upon detection, the entire message, including any embedded secrets, credentials, or sensitive data, is silently forwarded to a hardcoded QQ account (UIN 1821181277) controlled by the threat actor.

Socket’s AI Scanner has flagged this package as “Known Malware,” highlighting the urgent need for vigilance in chatbot plugin ecosystems.

Hidden Backdoor in koishi-plugin-pinhaofa

As chatbots become pivotal in customer engagement projected by eMarketer to be relied upon by one in three U.S. adults for banking by 2026 platforms like Koishi, a TypeScript framework enabling cross-platform bot deployment on QQ, Telegram, and Discord, are gaining traction.

With over a thousand community plugins available on its marketplace, Koishi grants these extensions full access to the bot’s runtime environment, allowing them to read and modify every message.

This unrestricted privilege, while powerful for developers, becomes a critical vulnerability when exploited by malicious packages like koishi-plugin-pinhaofa.

The plugin, published under the npm alias kuminfennel with ties to a matching GitHub account, operates within the bot’s trusted process, making it capable of real-time data theft without triggering conventional security alarms.

Its exfiltration over QQ’s private messaging blends seamlessly with normal traffic, evading web filters and endpoint defenses.

Rising Chatbot Adoption

The implications are severe across industries. Banking chatbots risk leaking payment card details or transaction hashes, e-commerce bots may expose order links with embedded JWT tokens alongside customer data, and healthcare bots could compromise patient codes or prescription IDs.

Without code review, administrators installing such plugins inadvertently enable breaches that could violate GDPR, HIPAA, or PCI compliance, leading to hefty fines and reputational damage.

The malicious code itself is deceptively simple, using a regex to detect eight-character hex strings and forwarding content to the attacker’s QQ ID without obfuscation or external dependencies, demonstrating how minimal effort can yield high-impact exploitation.

According to the Report, Socket warns that supply chain attacks on chatbot frameworks will escalate as enterprises expand conversational AI in finance, retail, and healthcare.

Mitigation requires isolating bots in containers restricted to approved communication channels, preventing covert data leaks even if a backdoor is present.

Additionally, integrating automated security tools like the free Socket GitHub app, CLI, or browser extension can flag suspicious patterns during package selection and installation, reducing the risk of compromise.

The package remains active on npm and GitHub, though removal petitions are underway.

Developers must act swiftly to audit their systems for this threat and adopt proactive defenses to safeguard sensitive data in an era where chatbots are both indispensable and increasingly targeted.

Indicators of Compromise (IOCs)

Indicator Type	Details
Malicious Package	koishi-plugin-pinhaofa
QQ Account	1821181277
npm Alias	kuminfennel
npm Registration Email	1821181277@qq[.]com
GitHub Repository	hxxps://github[.]com/1821181277

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!