OpenSSF/OSV advisory MAL-2026-14250 confirms this npm version as malicious. index.js stores a remote URL and a `curl -sL -o` command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply, then fetches and executes the retrieved content at install/import time. Hiding the destination and the download-and-run command behind char-code obfuscation is inconsistent with any legitimate installer or SDK, which references URLs in plain form...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in luluking1 (npm)
Details
index.js stores a remote URL and a `curl -sL -o` command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply, then fetches and executes the retrieved content at install/import time. Hiding the destination and the download-and-run command behind char-code obfuscation is inconsistent with any legitimate installer or SDK, which references URLs in plain form. The reconstructed shell invocation downloads an attacker-controlled payload to disk and runs it on the installer's machine, giving whoever published the package arbitrary code execution on any host that installs it.
Decision reason
OpenSSF Malicious Packages via OSV confirms luluking1@0.0.1 as malicious (MAL-2026-14250): Malicious code in luluking1 (npm)