Skip to main content
MalwarePublished Updated

dakumangalsingh (npm) · Malicious Code

Affects dakumangalsinghSource GCVE Database

0

Malicious package : remove dakumangalsingh and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:36 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13879

What to do

Remove dakumangalsingh from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmdakumangalsinghAffected
  • =1.0.1
  • =1.0.0
  • =1.1.0
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327) package.json declares a postinstall hook that executes a bundled Windows PE launcher (DakuMangalSingh\DakuMangalSingh.exe) at npm install time. The launcher is a jpackage wrapper that loads an embedded JAR named virus.jar containing classes Main, Executor, BatchExecutor, Fetch, RobotService (java.awt.Robot input synthesis), Screenshort (screen capture), and DeviceId (host fingerprinting) — the shape of a remote-command agent with screen-capture and input-synthesis capability. A bundled replicate.bat installs persistence by creating a shortcut to the dropped executable in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup so the payload auto-runs at every user logon. A cleanup.bat kills the process and recursively deletes the package folder, providing anti-forensics on the installer's host. Installing the package on Windows results in immediate arbitrary code execution, a persistent logon-triggered agent, and evidence-removal tooling — with no legitimate library functionality.

References

Community reviews

Loading reviews…