MAL-2026-12397 Malicious code in luluking (npm)
Malicious package
Published
MAL-2026-12397 is a malicious package: luluking (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12397/ (Markdown: https://insights.sbomify.com/MAL-2026-12397/index.md)
- Package
- luluking
- Registry
- npm
What is MAL-2026-12397?
MAL-2026-12397 is a malicious package in luluking, published on 5 Aug 2026.
Official description
On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode numeric arrays, invokes curl to download a remote script to a local.cache file, require()s it to execute the fetched Node code, then deletes the file. The decoded destination is https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js — a non-publisher endpoint. The charcode-array obfuscation of both the URL and the curl command hides the behavior from casual inspection. Installing the package yields arbitrary code execution on the installer's machine with content the author can change at any time.
What should I do about MAL-2026-12397?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.