MAL-2026-13879

Dashboard / Malicious Package / MAL-2026-13879

MAL-2026-13879

Summary: Malicious code in dakumangalsingh (npm)

Details: Source: amazon-inspector (502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327) package.json declares a postinstall hook that executes a bundled Windows PE launcher (DakuMangalSingh\DakuMangalSingh.exe) at npm install time. The launcher is a jpackage wrapper that loads an embedded JAR named virus.jar containing classes Main, Executor, BatchExecutor, Fetch, RobotService (java.awt.Robot input synthesis), Screenshort (screen capture), and DeviceId (host fingerprinting) — the shape of a remote-command agent with screen-capture and input-synthesis capability. A bundled replicate.bat installs persistence by creating a shortcut to the dropped executable in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup so the payload auto-runs at every user logon. A cleanup.bat kills the process and recursively deletes the package folder, providing anti-forensics on the installer's host. Installing the package on Windows results in immediate arbitrary code execution, a persistent logon-triggered agent, and evidence-removal tooling — with no legitimate library functionality.

References: https://www.npmjs.com/package/dakumangalsingh/v/1.0.1, https://www.npmjs.com/package/dakumangalsingh/v/1.0.0, https://www.npmjs.com/package/dakumangalsingh/v/1.1.0, https://www.npmjs.com/package/dakumangalsingh/v/2.0.1, https://www.npmjs.com/package/dakumangalsingh/v/1.2.0