{"id":"MAL-2026-13348","summary":"Malicious code in lakk-analytics (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52)\nlakk-analytics@9.9.11 runs `node index.js` from an npm install lifecycle hook, which loads `./lib/core` and constructs a subdomain from the installer's OS username, hostname, and current working directory (with a timestamp and the static prefix `asnbank`), then issues a `dns.resolve4()` query against `\u003cprefix\u003e.\u003cuser\u003e.\u003chost\u003e.\u003ccwd\u003e.\u003cts\u003e.oob.sl4x0.xyz`. This leaks installer identity via DNS to an out-of-band canary domain on every install. The destination host `oob.sl4x0.xyz` and API surface (`os`, `dns`, `process`, `userInfo`, `hostname`, `cwd`) are hidden as hex code-point arrays reconstructed with `String.fromCharCode` in sibling modules `lib/b02e30.js` and `lib/6ad264.js`. The README explicitly claims 'No network requests', which directly contradicts the observed install-time DNS beacon.\n","modified":"2026-08-05T16:51:05.971721647Z","published":"2026-08-05T15:41:20Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["9.9.11"],"id":"IN-MAL-2026-015794","import_time":"2026-08-05T16:13:45.882853429Z","modified_time":"2026-08-05T15:41:20Z","sha256":"d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/lakk-analytics/v/9.9.11"}],"affected":[{"package":{"name":"lakk-analytics","ecosystem":"npm","purl":"pkg:npm/lakk-analytics"},"versions":["9.9.11"],"database_specific":{"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4","tlsh":"38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"},{"sha256":"e3fd41f82bdf79310ef1d63bea0cdfcd4683cd2342c8fc195c22471064aca600","tlsh":"a4e068073303c94fa1880bfbba0050a1aa0d8b68a21dc1d6b528678500af447d0c0232","path":"lib/b02e30.js"}],"package_integrity":[{"hashes":{"sha1":"e50644c3820404ac1585201ec9cbae954f2a3a30","sha512_sri":"sha512-bMDDiXPXBri0KCHh+SHXMdqpciuWDFzAwM0eF5HTT62dp0V4tstJhm8kD+USW53qS0Y/WGhBhy3EPWvByIPNDQ=="},"filename":"lakk-analytics-9.9.11.tgz"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lakk-analytics/MAL-2026-13348.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}