Malicious code in dakumangalsingh (npm)
The npm package dakumangalsingh contains malicious code that executes a Windows PE launcher (DakuMangalSingh.exe) at install time via a postinstall hook. The launcher loads an embedded JAR (virus.jar) containing a remote-command agent with screen-capture, input-synthesis, and host-fingerprinting capabilities, along with persistence and anti-forensics mechanisms.
- Disclosed
- Last updated
- Blast radius
- Windows systems installing the package via npm
- Ecosystems
- Attack vectors
- Affected entities
- dakumangalsinghnpm package containing malicious Windows PE launcher and embedded JAR
The npm package dakumangalsingh was found to contain malicious code designed to compromise Windows systems. The package.json declares a postinstall hook that executes a bundled Windows PE launcher (DakuMangalSingh.exe) immediately upon npm install.
The launcher is a jpackage wrapper that loads an embedded JAR file named virus.jar. This JAR contains multiple classes including Main, Executor, BatchExecutor, Fetch, RobotService (for input synthesis via java.awt.Robot), Screenshort (for screen capture), and DeviceId (for host fingerprinting). The functionality indicates a remote-command agent capable of executing arbitrary commands, capturing screenshots, and synthesizing user input.
The package includes additional malicious components: a bundled replicate.bat script establishes persistence by creating a shortcut in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup to ensure the payload auto-runs at every user logon. A cleanup.bat script provides anti-forensics capability by killing the process and recursively deleting the package folder to remove evidence.
Installation on Windows results in immediate arbitrary code execution, establishment of a persistent logon-triggered agent, and automated evidence removal. The package contains no legitimate library functionality.
Indicators of compromise
- Packages
- dakumangalsingh
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-h2fc-hhv7-4596 · GitHub Advisory Database
Cite this entry
"Malicious code in dakumangalsingh (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-dakumangalsingh-npm-1h0g2n
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package - containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malware in @siwatfa/yorn
Malware was discovered in the npm package @siwatfa/yorn. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package