Malicious code in loadashjs (npm)
loadashjs is a typosquat package on npm containing malicious postinstall code that exfiltrates system information and downloads a Windows PE binary from a hardcoded GitHub release URL. The package masquerades as lodash but provides no legitimate functionality.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious loadashjs package from npm
- Ecosystems
- Attack vectors
- Affected entities
- loadashjsTyposquat of lodash; malicious postinstall script downloads and executes Windows PE binary
loadashjs is a typosquat of the legitimate lodash library published to npm. The package's index.js exports an empty object, with all functional code contained in a postinstall script that executes automatically upon npm install.
The postinstall script performs reconnaissance by reading /proc/version and /proc/sys/kernel/osrelease to detect the host environment (including WSL detection), then POSTs a JSON payload containing a platform label to http://193.70.34.101:20099/vote. It then XOR-decodes an obfuscated URL using the key 'stf2026' to obtain https://github.com/bebraz1/aPzM50V1AKG2rVlH/releases/download/null/main.exe, downloads the PE binary to %TEMP%\main.exe, and executes it with windowsHide.
On WSL or virtualized Linux hosts, additional XOR-encoded byte arrays (BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are decoded and concatenated into a shell command executed via child_process.exec to invoke the same malicious asset through a Windows-side bridge mechanism.
The downloaded binary is unrelated to any lodash functionality, is hosted under an unrelated personal GitHub account, and is fetched from an unpinned 'null' release tag, indicating no legitimate purpose.
Indicators of compromise
- Packages
- loadashjs
- Domains
- github.com/bebraz1/aPzM50V1AKG2rVlH
- IPs
- 193.70.34.101
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-q292-mqmf-w6fm · GitHub Advisory Database
Cite this entry
"Malicious code in loadashjs (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-loadashjs-npm-1ngy35
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package