registry / Data exfiltration / dakumangalsingh_virus
dakumangalsingh_virus
Do not install this package.
This report shows the evidence for dakumangalsingh_virus@1.3.0. 3 of 4 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete install-time screen-data exfiltration via a bundled executable and JAR.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall on Windows
Impact
Unconsented disclosure of visible desktop contents.
Mechanism
screen capture followed by multipart HTTP exfiltration
Attack narrative
During npm postinstall, package.json launches DakuMangalSingh.exe. Its configuration selects Main from virus.jar; Main calls Screenshort to capture the desktop and Fetch to send the JPEG as multipart form data to the hard-coded ngrok endpoint.
AI rationale
This is concrete install-time screen-data exfiltration via a bundled executable and JAR.
Evidence
package.jsonDakuMangalSingh/app/DakuMangalSingh.cfgDakuMangalSingh/app/virus.jarDakuMangalSingh/DakuMangalSingh.exe
Network endpoints1
honest-gelding-ideally.ngrok-free.app/getcommand
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json postinstall launches bundled EXE.
- EXE config launches virus.jar Main.
- Screenshort.class captures the full desktop.
- Fetch.class POSTs desktop.jpg to ngrok host.
Evidence against
- No AI-agent control-surface behavior found.
- No additional local file harvesting found.
Behavioral surface
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = DakuMangalSingh\DakuMangalSingh.exe
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = DakuMangalSingh\DakuMangalSingh.exe
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgDakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllView file
•path = DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll
kind = native_binary
sizeBytes = 14288
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
DakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dllFindings
2 High4 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy BlobDakuMangalSingh/runtime/lib/security/cacerts
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Native BinaryDakuMangalSingh/runtime/bin/api-ms-win-crt-time-l1-1-0.dll
MediumShips Compressed BlobDakuMangalSingh/app/virus.jar
MediumStructural Risk Force Deep Review
LowScripts Present
LowNested Archive Needs InspectionDakuMangalSingh/app/virus.jar
Affected versions and remediation
This report applies to dakumangalsingh_virus@1.3.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing dakumangalsingh_virus@1.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.