Malicious code in lodahsjs (npm)
The npm package lodahsjs is a typosquatting attack on 'lodash' that contains malicious code in its postinstall script. Upon installation, it exfiltrates system information to a C2 server and downloads and executes a Windows binary, with capability to bridge WSL environments to compromise the host Windows system.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious lodahsjs package from npm; potential for lateral movement to Windows hosts via WSL bridges.
- Ecosystems
- Attack vectors
- Affected entities
- lodahsjsTyposquatting package for 'lodash'; contains malicious postinstall script
The npm package lodahsjs is a typosquatting variant of the legitimate 'lodash' library. The package exports no legitimate functionality and instead uses a postinstall script (scripts/postinstall.js) to execute hostile actions at install time.
The malicious postinstall script performs two primary actions. First, it collects platform information including WSL/virtualized-Linux detection via /proc/version and /proc/sys/kernel/osrelease, then POSTs this data to a hardcoded C2 server at http://193.70.34.101:20099/vote. Second, it decodes an XOR-obfuscated URL (using key 'stf2026') that resolves to a Windows executable hosted on a personal GitHub account (https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe).
On Windows systems, the script downloads the binary to %TEMP%\main.exe and executes it. On WSL hosts, it constructs an XOR-decoded PowerShell command and uses child_process.exec with windowsHide:true to fetch and execute the same binary on the Windows side, enabling cross-environment compromise.
The package was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2026-14181. It has no legitimate use and exists solely to deliver the Windows payload to affected systems.
Indicators of compromise
- Packages
- lodahsjs
- Domains
- github.com/bebraz1/qPzM50V1AKG0rVlH
- IPs
- 193.70.34.101
- Hashes
- 6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-vwp4-47r6-w5mv · GitHub Advisory Database
Cite this entry
"Malicious code in lodahsjs (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-lodahsjs-npm-10p7vg
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package