MAL-2026-12397

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/luluking/MAL-2026-12397.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12397
Published
2026-08-05T13:08:01Z
Modified
2026-08-05T13:35:35.801445790Z
Summary
Malicious code in luluking (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3b88d4d8ec638e21c3b126dc9416ed8e2f3781bb1cc1d8ebe5a6579d698c6082)

On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode numeric arrays, invokes curl to download a remote script to a local.cache file, require()s it to execute the fetched Node code, then deletes the file. The decoded destination is https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js — a non-publisher endpoint. The charcode-array obfuscation of both the URL and the curl command hides the behavior from casual inspection. Installing the package yields arbitrary code execution on the installer's machine with content the author can change at any time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.0.1"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-08-05T13:08:53.535719377Z",
            "sha256": "3b88d4d8ec638e21c3b126dc9416ed8e2f3781bb1cc1d8ebe5a6579d698c6082",
            "id": "IN-MAL-2026-014895",
            "modified_time": "2026-08-05T13:08:01Z"
        }
    ]
}
References
Credits

Affected packages

npm / luluking

Package

Name
luluking
View open source insights on deps.dev
Purl
pkg:npm/luluking

Affected ranges

Affected versions

0.*
0.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/luluking/MAL-2026-12397.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "6b11909707e11b71f96004df465bc406a4a7c5133250e9e4faec895b9f9a860ed916b0",
            "sha256": "62ccc1e4162c4fbca1883412ca7b502200a799fb01219a5f2297c2882f449807"
        }
    ],
    "package_integrity": [
        {
            "filename": "luluking-0.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-OYeFMwK6qS2VXJlO2kYAqP4+fZ8Rv4NxJB2nEII2StupsMWzzrpgXF5tBHy7Sy4YdGIbKsNRUQfF+1pE9NmMVg==",
                "sha1": "df528f77ea4a32b589078e71249fc9d641bd50e2"
            }
        }
    ]
}