Malicious code in luluking1 (npm)

The npm package luluking1 was found to contain malicious code in its index.js file. The malicious payload used String.fromCharCode.apply to reconstruct a remote URL and a curl command from numeric char-code arrays at runtime, obfuscating the attack from static inspection.\n\nUpon installation or import, the package reconstructs and executes a shell invocation that downloads an attacker-controlled payload to disk and runs it with the privileges of the installing user. This grants arbitrary code execution on any host that installs the compromised package.\n\nThe use of char-code obfuscation to hide the destination URL and download-and-run command is inconsistent with legitimate installers or SDKs, which typically reference URLs in plain form. This obfuscation technique is a strong indicator of malicious intent.\n\nThe malicious package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.