Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in lodhash-cli (npm)

lodhash-cli is a typosquat package on npm containing malicious postinstall code that downloads and executes a Windows binary, with special handling for WSL environments. The package was identified and reported by OpenSSF.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or system that installed lodhash-cli from npm
Ecosystems
Attack vectors
Affected entities
  • lodhash-cliTyposquat of lodash; malicious postinstall dropper

lodhash-cli is a typosquat of the legitimate lodash package published to npm. The package's main entry point exports an empty object and contains no legitimate functionality; its sole behavior is a postinstall dropper script.

The postinstall script (scripts/postinstall.js) XOR-decodes (using key 'stf2026') a URL pointing to github.com/bebraz1/qPzM50V1AKG0rVlH/releases/.../main.exe, downloads the binary to %TEMP%\main.exe, and spawns it detached with windowsHide. When running under WSL, the script detects the environment via /proc/version, /proc/sys/kernel/osrelease, and WSL_DISTRO_NAME environment variable, then XOR-decodes and executes a powershell.exe command to run the same fetched binary on the Windows host from within the Linux subsystem.

In parallel, the script sends a POST request to http://193.70.34.101:20099/vote (with the IP address assembled from byte arrays to evade literal-string detection) as an install-success beacon. All URLs and shell commands are stored as XOR-encoded byte arrays; no hash or signature verification is performed on the fetched executable. The download source is a personal GitHub account unrelated to any official lodash publisher.

The incident was identified and credited to OpenSSF's malicious-packages repository.

Indicators of compromise

Packages
  • lodhash-cli
Domains
  • github.com/bebraz1/qPzM50V1AKG0rVlH
IPs
  • 193.70.34.101

Remediation

  • Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.

Sources

  1. GitHub Advisory GHSA-c69j-j9vq-f8g3 · GitHub Advisory Database

Cite this entry

"Malicious code in lodhash-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-lodhash-cli-npm-i1uicf

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. resolvedcritical

    Malicious code in create-coin (npm)

    create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.

    npmCompromised packageTyposquatting
  2. containedcritical

    Malicious code in chai-as-testkit (npm)

    The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.

    npmTyposquattingCompromised package
  3. resolvedcritical

    Malicious code in @next-fonts/font (npm)

    @next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.

    npmTyposquattingCompromised package
  4. resolvedcritical

    Malicious code in chai-as-soul (npm)

    chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.

    npmTyposquattingCompromised package