dakumangalsingh

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327)
package.json declares a postinstall hook that executes a bundled Windows PE launcher (DakuMangalSingh\DakuMangalSingh.exe) at npm install time. The launcher is a jpackage wrapper that loads an embedded JAR named virus.jar containing classes Main, Executor, BatchExecutor, Fetch, RobotService (java.awt.Robot input synthesis), Screenshort (screen capture), and DeviceId (host fingerprinting) — the shape of a remote-command agent with screen-capture and input-synthesis capability. A bundled replicate.bat installs persistence by creating a shortcut to the dropped executable in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup so the payload auto-runs at every user logon. A cleanup.bat kills the process and recursively deletes the package folder, providing anti-forensics on the installer's host. Installing the package on Windows results in immediate arbitrary code execution, a persistent logon-triggered agent, and evidence-removal tooling — with no legitimate library functionality.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b33600c98c614ac591d9e3949e4ec5bfbae4052f/osv/malicious/npm/dakumangalsingh/MAL-2026-13879.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b33600c98c614ac591d9e3949e4ec5bfbae4052f/osv/malicious/npm/dakumangalsingh/MAL-2026-13879.json
- https://www.npmjs.com/package/dakumangalsingh/v/1.0.0
- https://www.npmjs.com/package/dakumangalsingh/v/1.0.1
- https://www.npmjs.com/package/dakumangalsingh/v/1.1.0
- https://github.com/advisories/GHSA-h2fc-hhv7-4596

Compromised versions (1)

• = 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.