luluking

{"modified":"2026-08-05T13:08:01Z","published":"2026-08-05T13:08:01Z","schema_version":"1.7.4","id":"MAL-2026-12397","summary":"Malicious code in luluking (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3b88d4d8ec638e21c3b126dc9416ed8e2f3781bb1cc1d8ebe5a6579d698c6082)\nOn npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode numeric arrays, invokes curl to download a remote script to a local.cache file, require()s it to execute the fetched Node code, then deletes the file. The decoded destination is https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js — a non-publisher endpoint. The charcode-array obfuscation of both the URL and the curl command hides the behavior from casual inspection. Installing the package yields arbitrary code execution on the installer's machine with content the author can change at any time.\n","affected":[{"package":{"ecosystem":"npm","name":"luluking"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"62ccc1e4162c4fbca1883412ca7b502200a799fb01219a5f2297c2882f449807","tlsh":"6b11909707e11b71f96004df465bc406a4a7c5133250e9e4faec895b9f9a860ed916b0"}],"package_integrity":[{"filename":"luluking-0.0.1.tgz","hashes":{"sha1":"df528f77ea4a32b589078e71249fc9d641bd50e2","sha512_sri":"sha512-OYeFMwK6qS2VXJlO2kYAqP4+fZ8Rv4NxJB2nEII2StupsMWzzrpgXF5tBHy7Sy4YdGIbKsNRUQfF+1pE9NmMVg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/luluking/v/0.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014895","import_time":"2026-08-05T13:08:53.535719377Z","modified_time":"2026-08-05T13:08:01Z","sha256":"3b88d4d8ec638e21c3b126dc9416ed8e2f3781bb1cc1d8ebe5a6579d698c6082","source":"amazon-inspector","versions":["0.0.1"]}]}}