MAL-2026-13348

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lakk-analytics/MAL-2026-13348.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13348
Published
2026-08-05T15:41:20Z
Modified
2026-08-05T16:51:05.971721647Z
Summary
Malicious code in lakk-analytics (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52)

lakk-analytics@9.9.11 runs node index.js from an npm install lifecycle hook, which loads ./lib/core and constructs a subdomain from the installer's OS username, hostname, and current working directory (with a timestamp and the static prefix asnbank), then issues a dns.resolve4() query against <prefix>.<user>.<host>.<cwd>.<ts>.oob.sl4x0.xyz. This leaks installer identity via DNS to an out-of-band canary domain on every install. The destination host oob.sl4x0.xyz and API surface (os, dns, process, userInfo, hostname, cwd) are hidden as hex code-point arrays reconstructed with String.fromCharCode in sibling modules lib/b02e30.js and lib/6ad264.js. The README explicitly claims 'No network requests', which directly contradicts the observed install-time DNS beacon.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T16:13:45.882853429Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:41:20Z",
            "sha256": "d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52",
            "id": "IN-MAL-2026-015794",
            "versions": [
                "9.9.11"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / lakk-analytics

Package

Name
lakk-analytics
View open source insights on deps.dev
Purl
pkg:npm/lakk-analytics

Affected ranges

Affected versions

9.*
9.9.11

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lakk-analytics/MAL-2026-13348.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4",
            "path": "lib/core.js",
            "tlsh": "38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"
        },
        {
            "sha256": "e3fd41f82bdf79310ef1d63bea0cdfcd4683cd2342c8fc195c22471064aca600",
            "tlsh": "a4e068073303c94fa1880bfbba0050a1aa0d8b68a21dc1d6b528678500af447d0c0232",
            "path": "lib/b02e30.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "lakk-analytics-9.9.11.tgz",
            "hashes": {
                "sha1": "e50644c3820404ac1585201ec9cbae954f2a3a30",
                "sha512_sri": "sha512-bMDDiXPXBri0KCHh+SHXMdqpciuWDFzAwM0eF5HTT62dp0V4tstJhm8kD+USW53qS0Y/WGhBhy3EPWvByIPNDQ=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]