MAL-2026-13348
Malicious code in lakk-analytics (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52) lakk-analytics@9.9.11 runs `node index.js` from an npm install lifecycle hook, which loads `./lib/core` and constructs a subdomain from the installer's OS username, hostname, and current working directory (with a timestamp and the static prefix `asnbank`), then issues a `dns.resolve4()` query against `<prefix>.<user>.<host>.<cwd>.<ts>.oob.sl4x0.xyz`. This leaks installer identity via DNS to an out-of-band canary domain on every install. The destination host `oob.sl4x0.xyz` and API surface (`os`, `dns`, `process`, `userInfo`, `hostname`, `cwd`) are hidden as hex code-point arrays reconstructed with `String.fromCharCode` in sibling modules `lib/b02e30.js` and `lib/6ad264.js`. The README explicitly claims 'No network requests', which directly contradicts the observed install-time DNS beacon.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for lakk-analytics (npm). Pin to a known-safe version or switch to an alternative.