Malicious Koishi Chatbot Plugin Exfiltrates Messages Triggered by 8-Character Hex Strings
Socket’s Threat Research Team uncovered a malicious npm package, koishi-plugin-pinhaofa, that exfiltrates messages from Koishi chatbots using 8-character hex strings, potentially leaking sensitive data to a hardcoded QQ account
2025. 05. 20.