The 'luluking3' npm package (version 0.0.1) includes a postinstall hook that runs an obfuscated script. This script reconstructs a URL and shell command using character code arrays, then uses 'curl' to download a JavaScript file ('crypto.js') from a third-party Aliyun OSS bucket. The downloaded file is required and executed within the installer's Node.js process before being deleted. Since the remote bucket is mutable and controlled by the publisher, arbitrary attacker-supplied JavaScript can be executed with the privileges of the user running the installation. The obfuscation of both the URL and shell command suggests deliberate evasion of static inspection.

This vulnerability allows arbitrary code execution during package installation, potentially leading to compromise of the user's environment with the same privileges as the user running 'npm install'. Because the remote code is fetched from a mutable third-party bucket controlled by the attacker, the payload can be changed at any time, increasing the risk and flexibility of exploitation.

No official patch or remediation is currently available. Users should avoid installing version 0.0.1 of the 'luluking3' package. Verify package integrity and source before installation. Consider using package auditing tools and restricting installation of untrusted packages. Monitor vendor advisories for updates or fixes.