{"id":"MAL-2026-12399","summary":"Malicious code in luluking3 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee)\nOn `npm install`, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode char-code arrays (obfuscated behind `_0x`-prefixed variables), invokes `curl -sL -o \u003chidden.cache path\u003e` to download `https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js`, `require()`s the downloaded file inside the installer's Node process, and then unlinks it. The remote endpoint is a third-party Aliyun OSS bucket whose contents are mutable and controlled by the publisher, so arbitrary attacker-supplied JavaScript executes with the privileges of the user running `npm install`. Obfuscation of both the URL and the shell command indicates intent to evade static inspection.\n","modified":"2026-08-05T13:35:36.221379051Z","published":"2026-08-05T13:02:19Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T13:02:19Z","sha256":"9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee","source":"amazon-inspector","versions":["0.0.1"],"id":"IN-MAL-2026-014858","import_time":"2026-08-05T13:08:51.453346538Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/luluking3/v/0.0.1"}],"affected":[{"package":{"name":"luluking3","ecosystem":"npm","purl":"pkg:npm/luluking3"},"versions":["0.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/luluking3/MAL-2026-12399.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"5311909747e12b71bd6004df465fc402a4a7c5133250eae4faec8a5f9f9a824ed916b0","path":"index.js","sha256":"eef4d7a9a9cbfd3d9d6f807adefeaaf1934f09d10f264fafae586f7349524f7c"}],"package_integrity":[{"filename":"luluking3-0.0.1.tgz","hashes":{"sha1":"378e300d84aa177cbe1554d16cef9dde3651f063","sha512_sri":"sha512-oIc4hMphJe4+kY9NcoVR+zTfOGtQVPeerJu4ugaIvYnidv0+qpMUpnBBqrjGH0EN82OyHigr9EFWso9f1Xv55Q=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}