Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in lodahs-cli (npm)

lodahs-cli, a typosquatting package masquerading as a lodash CLI tool, contained a malicious postinstall script that beacons to a hardcoded IP, downloads and executes a Windows executable, and can cross WSL boundaries to compromise the host system.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All npm users who installed lodahs-cli
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • lodahs-clinpm package containing malicious postinstall script

The npm package lodahs-cli contained malicious code in its postinstall lifecycle script (scripts/postinstall.js) that executed automatically upon installation. The script performed three attacker-controlled actions: it sent a platform fingerprint beacon to http://193.70.34.101:20099/vote, downloaded and executed main.exe from an obfuscated GitHub repository (https://github.com/beb1raz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe), and included logic to cross WSL boundaries and execute the same payload on Windows hosts when detected.

The package name is a reversal/typosquatting variant of 'lodash' but contained no legitimate CLI functionality—it was purely a dropper. The malicious URLs and IP addresses were obfuscated using XOR encoding (key 'stf2026') and array concatenation to evade static detection.

The incident was identified and credited to the OpenSSF malicious-packages repository (MAL-2026-14180), indicating the package has been cataloged and removed from npm.

Indicators of compromise

Packages
  • lodahs-cli
Domains
  • github.com
IPs
  • 193.70.34.101

Remediation

  • Immediately uninstall lodahs-cli from all systems
  • Audit npm install logs to identify when lodahs-cli was installed
  • Scan systems for main.exe and any suspicious processes spawned during or after npm install
  • Review outbound network connections to 193.70.34.101:20099 in firewall/proxy logs
  • On WSL systems, check Windows host for unauthorized executables and processes
  • Use npm audit to identify if lodahs-cli is listed as a dependency in any projects
  • Consider using npm package lock files and integrity verification to prevent similar attacks
  • Monitor for indicators of compromise from the downloaded executable payload

Sources

  1. GitHub Advisory GHSA-qq9w-rvjj-f8h3 · GitHub Advisory Database

Cite this entry

"Malicious code in lodahs-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-lodahs-cli-npm-1yro1o

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in 3-buildsight-web (npm)

    The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.

    npmCompromised package
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in create-coin (npm)

    create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.

    npmCompromised packageTyposquatting
  4. resolvedcritical

    Malicious code in @syncraft-labs/vue (npm)

    The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.

    npmCompromised package