Malicious npm Package in Koishi Chatbots Steals Sensitive Data in Real Time
Socket’s Threat Research Team has identified a compromised npm package named koishi-plugin-pinhaofa , which poses as a spelling-autocorrect tool for Koishi chatbots.
Socket’s Threat Research Team has identified a compromised npm package named koishi-plugin-pinhaofa , which poses as a spelling-autocorrect tool for Koishi chatbots.
This package includes a data-exfiltration backdoor that scans incoming messages for an eight-character hexadecimal string, commonly used for Git commit hashes, truncated JWT tokens, API keys, or device IDs. When detected, the entire message along with any sensitive data is forwarded to a hardcoded QQ account (UIN 1821181277) managed by the threat actor.
Socket’s AI Scanner has classified this package as “Known Malware,” emphasizing the need for vigilance in chatbot plugin ecosystems.
Hidden Backdoor in koishi-plugin-pinhaofa
Koishi, a TypeScript framework for cross-platform bot deployment on QQ, Telegram, and Discord, is increasing in use. It offers over a thousand community plugins, providing extensive access to the bot’s runtime environment, allowing them to read and modify messages.
This access becomes a vulnerability when exploited by malicious packages like koishi-plugin-pinhaofa . The plugin, published under the npm alias kuminfennel with a corresponding GitHub account, operates within the bot’s trusted process, capable of real-time data theft without triggering security alarms.
Its data exfiltration through QQ’s private messaging system blends with normal traffic, bypassing web filters and endpoint defenses.
The impact is significant across industries. Banking chatbots risk exposing payment card details, e-commerce bots may reveal order links with JWT tokens, and healthcare bots could leak patient information.
When detected, the entire message along with any sensitive data is forwarded to a hardcoded QQ account (UIN 1821181277) managed by the threat actor.
Without thorough code reviews, administrators may inadvertently enable breaches, potentially violating GDPR, HIPAA, or PCI compliance, resulting in fines and reputational damage. The malicious code uses a simple regex to detect hex strings and forwards the content to the attacker’s QQ ID without obfuscation, showing how minimal effort can lead to significant exploitation.
According to a report by Socket, supply chain attacks on chatbot frameworks are expected to increase as enterprises expand conversational AI usage in finance, retail, and healthcare.
Mitigation strategies include isolating bots in containers with restricted communication channels to prevent data leaks even if a backdoor is present. Additionally, employing automated security tools like the Socket GitHub app, CLI, or browser extension can help identify suspicious patterns during package selection and installation, reducing compromise risk.
The package is still active on npm and GitHub, though removal efforts are ongoing. Developers must urgently audit their systems for this threat and implement proactive defenses to protect sensitive data in the evolving chatbot landscape.
Indicator Type Details
Malicious Package koishi-plugin-pinhaofa
QQ Account 1821181277
npm Alias kuminfennel
npm Registration Email 1821181277@qq[.]com
GitHub Repository hxxps://github[.]com/1821181277
Based on reporting by GBHackers.