Malicious code in luluking1 (npm)

The 'luluking1' npm package (version 0.0.1) includes code in its index.js file that stores a remote URL and a curl command as numeric char-code arrays. At runtime, these arrays are converted back into strings using String.fromCharCode.apply, reconstructing a shell command that downloads and executes a payload from an attacker-controlled server during package installation or import. This behavior results in arbitrary code execution on any system that installs the package. The obfuscation technique used to hide the URL and command is inconsistent with legitimate software practices and is a clear indicator of malicious activity.

Any system that installs or imports the 'luluking1' package version 0.0.1 is at risk of arbitrary code execution by an attacker. This can lead to full compromise of the host machine, including data theft, system manipulation, or further malware deployment.

No official patch or remediation is currently available. Users should avoid installing or using the 'luluking1' package version 0.0.1. Review your dependency tree for this package and remove it if found. Monitor for updates from the package maintainer or npm security advisories for any future fixes.