{"id":"MAL-2026-14250","summary":"Malicious code in luluking1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4)\nindex.js stores a remote URL and a `curl -sL -o` command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply, then fetches and executes the retrieved content at install/import time. Hiding the destination and the download-and-run command behind char-code obfuscation is inconsistent with any legitimate installer or SDK, which references URLs in plain form. The reconstructed shell invocation downloads an attacker-controlled payload to disk and runs it on the installer's machine, giving whoever published the package arbitrary code execution on any host that installs it.\n","modified":"2026-08-19T05:00:16.459319496Z","published":"2026-08-19T04:20:43Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018361","import_time":"2026-08-19T04:47:47.116154359Z","modified_time":"2026-08-19T04:20:43Z","sha256":"fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4","source":"amazon-inspector","versions":["0.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/luluking1/v/0.0.1"}],"affected":[{"package":{"name":"luluking1","ecosystem":"npm","purl":"pkg:npm/luluking1"},"versions":["0.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/luluking1/MAL-2026-14250.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"luluking1-0.0.1.tgz","hashes":{"sha512_sri":"sha512-cH2C5mxPO2sYq1q0Mf6USBfD49WOEOuBXQNXghUv/jQJNBQF7i0hwySe7ae+ibfZaqAYCnu5MKGWvH5VK0X2lw==","sha1":"7f00bffe59456b72fc50131de14f50791ef4bd6f"}}],"evidence_files":[{"path":"index.js","sha256":"62ccc1e4162c4fbca1883412ca7b502200a799fb01219a5f2297c2882f449807","tlsh":"6b11909707e11b71f96004df465bc406a4a7c5133250e9e4faec895b9f9a860ed916b0"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}