Malicious code in lodash-lib (npm)

lodash-lib is a typosquatting package on npm designed to impersonate the legitimate lodash library. The package exports an empty object in its main index.js file, with all malicious behavior hidden in scripts/postinstall.js.

Upon installation, the postinstall script XOR-decodes (using key 'stf2026') a URL and PowerShell command from obfuscated integer arrays. It then POSTs the installer's platform label to a hardcoded IP endpoint (http://193.70.34.101:20099/vote), with the IP address itself assembled from a string array to evade static scanning. The script downloads an executable from an unrelated GitHub repository (https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe) to %TEMP%/main.exe and executes it with detached stdio. On Windows Subsystem for Linux (WSL), the script bridges the download-and-execute command to the Windows host via PowerShell.

The attack exhibits multiple indicators of malicious intent: the GitHub repository hosting the binary is unrelated to the package publisher, the download URL is unpinned and unversioned, no cryptographic hash or signature verification is performed, and deceptive naming conventions ('addon', 'telemetry') are used throughout the code. This incident was identified and credited to the OpenSSF's malicious-packages repository.