registry / dakumangalsingh / 1.2.0

dakumangalsingh@1.2.0

AI Security Review

scanned 17h ago · by lpm-firewall-ai

On Windows npm installation, postinstall launches a bundled Java application. The application captures the desktop, uploads it with a device ID, and accepts remote UI-control commands.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall on Windows

Impact

Unconsented screenshot exfiltration and remote control of keyboard, mouse, and clipboard.

Mechanism

screen capture and remote command-and-control via a bundled launcher

Attack narrative

Installing the package on Windows invokes its bundled executable without user action. Its configured Java payload captures the screen, derives a device identifier, and POSTs both to a hard-coded ngrok endpoint. The response is passed to a robot-control component that can inject keyboard and mouse actions and modify the clipboard, enabling attacker-directed interaction with the victim desktop.

Rationale

This is concrete install-time spyware and remote-control behavior, not an inert bundled application. The hard-coded endpoint, screen exfiltration, and remote UI automation establish a malicious chain.

Evidence

package.jsonDakuMangalSingh/app/DakuMangalSingh.cfgDakuMangalSingh/app/virus.jarDakuMangalSingh/DakuMangalSingh.exe

Network endpoints1

monogamy-google-mustang.ngrok-free.dev/getcommand

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13879

Source

OpenSSF Malicious Packages via OSV

Summary

References

OSV advisory

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs a bundled Windows executable during postinstall.
The launcher config loads virus.jar with Main as its entry class.
Jar inspection shows Main captures a screen, uploads it, then processes the server response.
Fetch sends a device identifier and JPEG screenshot to monogamy-google-mustang.ngrok-free.dev.
RobotService supports server-directed mouse, keyboard, clipboard, and scrolling actions.

Evidence against

No benign package functionality or source entrypoint was found.
No batch files referenced by the command helper are present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

6 flagged

package.jsonView file

Lines 1-12json

2 "name": "dakumangalsingh",

3 "version": "1.2.0",

4 "main": "index.js",

5 "scripts": {

6 "postinstall": ".\\DakuMangalSingh\\DakuMangalSingh.exe"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L6

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L6

7 },

8 "author": "",

9 "license": "ISC",

10 "description": ""

11}

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView file

•path = DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll kind = native_binary sizeBytes = 14288 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView on unpkg

DakuMangalSingh/app/virus.jarView file

•path = DakuMangalSingh/app/virus.jar kind = high_entropy_blob sizeBytes = 13446 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

DakuMangalSingh/app/virus.jarView on unpkg

•path = DakuMangalSingh/app/virus.jar kind = compressed_blob sizeBytes = 13446 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

DakuMangalSingh/app/virus.jarView on unpkg

•path = DakuMangalSingh/app/virus.jar kind = nested_archive_needs_inspection sizeBytes = 13446 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

DakuMangalSingh/app/virus.jarView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = .\DakuMangalSingh\DakuMangalSingh.exe

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = .\DakuMangalSingh\DakuMangalSingh.exe

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView file

•path = DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll kind = native_binary sizeBytes = 14288 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll

Findings

2 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy BlobDakuMangalSingh/app/virus.jar

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Native BinaryDakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll

MediumShips Compressed BlobDakuMangalSingh/app/virus.jar

MediumStructural Risk Force Deep Review

LowScripts Present

LowNested Archive Needs InspectionDakuMangalSingh/app/virus.jar