MAL-2026-14250
Malicious code in luluking1 (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4) index.js stores a remote URL and a `curl -sL -o` command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply, then fetches and executes the retrieved content at install/import time. Hiding the destination and the download-and-run command behind char-code obfuscation is inconsistent with any legitimate installer or SDK, which references URLs in plain form. The reconstructed shell invocation downloads an attacker-controlled payload to disk and runs it on the installer's machine, giving whoever published the package arbitrary code execution on any host that installs it.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for luluking1 (npm). Pin to a known-safe version or switch to an alternative.