dakumangalsingh
This report shows the evidence for dakumangalsingh@2.0.1. 5 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete, automatically triggered remote-access payload with host fingerprinting and screenshot exfiltration. It is malicious, not an inert bundled artifact.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall on Windows
Impact
Unconsented host fingerprinting, screen-data exfiltration, and remote keyboard/mouse/clipboard control.
Mechanism
install-time launcher executes remote-control and screenshot-exfiltration payload
Attack narrative
During npm postinstall, the package launches DakuMangalSingh.exe. Its configuration starts Main from virus.jar. Static inspection of the JAR classes shows device registration and command polling to an ngrok endpoint, desktop capture serialized as JPEG, screenshot upload, and AWT Robot operations for mouse, keyboard, clipboard, and scrolling. The payload also constructs a device identifier from Windows MachineGuid, MAC address, and username.
AI rationale
This is a concrete, automatically triggered remote-access payload with host fingerprinting and screenshot exfiltration. It is malicious, not an inert bundled artifact.
Evidence
package.jsonDakuMangalSingh/app/DakuMangalSingh.cfgDakuMangalSingh/app/virus.jarDakuMangalSingh/DakuMangalSingh.exe
Network endpoints3
monogamy-google-mustang.ngrok-free.dev/getcommandmonogamy-google-mustang.ngrok-free.dev/registerdevicemonogamy-google-mustang.ngrok-free.dev/getactivedevice
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- postinstall launches a bundled Windows executable.
- Bundled JAR registers a device and posts screenshots to monogamy-google-mustang.ngrok-free.dev.
- JAR captures the desktop via AWT Robot and uploads JPEG data.
- JAR polls commands and drives mouse, keyboard, clipboard, and screen controls.
- JAR derives a host identifier from MachineGuid, MAC address, and username.
Evidence against
Behavioral surface
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = .\DakuMangalSingh\DakuMangalSingh.exe
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = .\DakuMangalSingh\DakuMangalSingh.exe
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgDakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView file
•path = DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll
kind = native_binary
sizeBytes = 14288
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView on unpkgDakuMangalSingh/app/virus.jarView file
•path = DakuMangalSingh/app/virus.jar
kind = high_entropy_blob
sizeBytes = 13278
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
DakuMangalSingh/app/virus.jarView on unpkg•path = DakuMangalSingh/app/virus.jar
kind = compressed_blob
sizeBytes = 13278
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
DakuMangalSingh/app/virus.jarView on unpkg•path = DakuMangalSingh/app/virus.jar
kind = nested_archive_needs_inspection
sizeBytes = 13278
magicHex = [redacted]
Low
Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
DakuMangalSingh/app/virus.jarView on unpkgFindings
2 High4 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy BlobDakuMangalSingh/app/virus.jar
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Native BinaryDakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll
MediumShips Compressed BlobDakuMangalSingh/app/virus.jar
MediumStructural Risk Force Deep Review
LowScripts Present
LowNested Archive Needs InspectionDakuMangalSingh/app/virus.jar
Affected versions and remediation
This report applies to dakumangalsingh@2.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing dakumangalsingh@2.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
5 known versions2.0.1latestshownMaliciousMalwareBlockPublishedAug 14, 2026, 12:21 PM1.2.0MaliciousMalwareBlockPublishedAug 14, 2026, 11:03 AM1.1.0MaliciousRemote Code ExecutionBlockPublishedAug 12, 2026, 9:09 AM1.0.1MaliciousMalwareBlockPublishedAug 11, 2026, 9:06 PM1.0.0MaliciousData ExfiltrationBlockPublishedAug 11, 2026, 8:53 PM