MAL-2026-14250

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/luluking1/MAL-2026-14250.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14250
Published
2026-08-19T04:20:43Z
Modified
2026-08-19T05:00:16.459319496Z
Summary
Malicious code in luluking1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4)

index.js stores a remote URL and a curl -sL -o command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply, then fetches and executes the retrieved content at install/import time. Hiding the destination and the download-and-run command behind char-code obfuscation is inconsistent with any legitimate installer or SDK, which references URLs in plain form. The reconstructed shell invocation downloads an attacker-controlled payload to disk and runs it on the installer's machine, giving whoever published the package arbitrary code execution on any host that installs it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T04:47:47.116154359Z",
            "sha256": "fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4",
            "modified_time": "2026-08-19T04:20:43Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018361",
            "versions": [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / luluking1

Package

Name
luluking1
View open source insights on deps.dev
Purl
pkg:npm/luluking1

Affected ranges

Affected versions

0.*
0.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/luluking1/MAL-2026-14250.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "62ccc1e4162c4fbca1883412ca7b502200a799fb01219a5f2297c2882f449807",
            "tlsh": "6b11909707e11b71f96004df465bc406a4a7c5133250e9e4faec895b9f9a860ed916b0",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "luluking1-0.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-cH2C5mxPO2sYq1q0Mf6USBfD49WOEOuBXQNXghUv/jQJNBQF7i0hwySe7ae+ibfZaqAYCnu5MKGWvH5VK0X2lw==",
                "sha1": "7f00bffe59456b72fc50131de14f50791ef4bd6f"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]