MAL-2026-14250
Malicious code in luluking1 (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4) index.js stores a remote URL and a `curl -sL -o` command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply, then fetches and executes the retrieved content at install/import time. Hiding the destination and the download-and-run command behind char-code obfuscation is inconsistent with any legitimate installer or SDK, which references URLs in plain form. The reconstructed shell invocation downloads an attacker-controlled payload to disk and runs it on the installer's machine, giving whoever published the package arbitrary code execution on any host that installs it.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for luluking1 (npm). Pin to a known-safe version or switch to an alternative.