MAL-2026-12397

    Dashboard / Malicious Package / MAL-2026-12397

    MAL-2026-12397

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in luluking (npm)

    Details: Source: amazon-inspector (3b88d4d8ec638e21c3b126dc9416ed8e2f3781bb1cc1d8ebe5a6579d698c6082) On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode numeric arrays, invokes curl to download a remote script to a local.cache file, require()s it to execute the fetched Node code, then deletes the file. The decoded destination is https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js — a non-publisher endpoint. The charcode-array obfuscation of both the URL and the curl command hides the behavior from casual inspection. Installing the package yields arbitrary code execution on the installer's machine with content the author can change at any time.

    References: https://www.npmjs.com/package/luluking/v/0.0.1

    Affected packages

    Package

    Name: luluking

    Purl: pkg:npm/luluking

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1
    MAL-2026-12397 | CVE-DB