luluking1

{"modified":"2026-08-19T04:20:43Z","published":"2026-08-19T04:20:43Z","schema_version":"1.7.4","id":"MAL-2026-14250","summary":"Malicious code in luluking1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4)\nindex.js stores a remote URL and a `curl -sL -o` command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply, then fetches and executes the retrieved content at install/import time. Hiding the destination and the download-and-run command behind char-code obfuscation is inconsistent with any legitimate installer or SDK, which references URLs in plain form. The reconstructed shell invocation downloads an attacker-controlled payload to disk and runs it on the installer's machine, giving whoever published the package arbitrary code execution on any host that installs it.\n","affected":[{"package":{"ecosystem":"npm","name":"luluking1"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"62ccc1e4162c4fbca1883412ca7b502200a799fb01219a5f2297c2882f449807","tlsh":"6b11909707e11b71f96004df465bc406a4a7c5133250e9e4faec895b9f9a860ed916b0"}],"package_integrity":[{"filename":"luluking1-0.0.1.tgz","hashes":{"sha1":"7f00bffe59456b72fc50131de14f50791ef4bd6f","sha512_sri":"sha512-cH2C5mxPO2sYq1q0Mf6USBfD49WOEOuBXQNXghUv/jQJNBQF7i0hwySe7ae+ibfZaqAYCnu5MKGWvH5VK0X2lw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/luluking1/v/0.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018361","import_time":"2026-08-19T04:47:47.116154359Z","modified_time":"2026-08-19T04:20:43Z","sha256":"fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4","source":"amazon-inspector","versions":["0.0.1"]}]}}