luluking3

{"modified":"2026-08-05T13:02:19Z","published":"2026-08-05T13:02:19Z","schema_version":"1.7.4","id":"MAL-2026-12399","summary":"Malicious code in luluking3 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee)\nOn `npm install`, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode char-code arrays (obfuscated behind `_0x`-prefixed variables), invokes `curl -sL -o <hidden.cache path>` to download `https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js`, `require()`s the downloaded file inside the installer's Node process, and then unlinks it. The remote endpoint is a third-party Aliyun OSS bucket whose contents are mutable and controlled by the publisher, so arbitrary attacker-supplied JavaScript executes with the privileges of the user running `npm install`. Obfuscation of both the URL and the shell command indicates intent to evade static inspection.\n","affected":[{"package":{"ecosystem":"npm","name":"luluking3"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"eef4d7a9a9cbfd3d9d6f807adefeaaf1934f09d10f264fafae586f7349524f7c","tlsh":"5311909747e12b71bd6004df465fc402a4a7c5133250eae4faec8a5f9f9a824ed916b0"}],"package_integrity":[{"filename":"luluking3-0.0.1.tgz","hashes":{"sha1":"378e300d84aa177cbe1554d16cef9dde3651f063","sha512_sri":"sha512-oIc4hMphJe4+kY9NcoVR+zTfOGtQVPeerJu4ugaIvYnidv0+qpMUpnBBqrjGH0EN82OyHigr9EFWso9f1Xv55Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/luluking3/v/0.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014858","import_time":"2026-08-05T13:08:51.453346538Z","modified_time":"2026-08-05T13:02:19Z","sha256":"9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee","source":"amazon-inspector","versions":["0.0.1"]}]}}