Malicious code in lodsh-cli (npm)
lodsh-cli, a typosquat of lodash-cli on npm, contained malicious code in its postinstall script that executed arbitrary remote code and exfiltrated system information. The package downloaded a Windows executable and sent platform data to a hardcoded IP address.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed lodsh-cli
- Ecosystems
- Attack vectors
- Affected entities
- lodsh-cliTyposquat of lodash-cli
lodsh-cli is a typosquatting attack targeting users who intended to install lodash-cli. The malicious package contained hostile code in scripts/postinstall.js that executed automatically upon npm installation.
The postinstall script performed two primary malicious actions. First, it XOR-decoded a hardcoded URL using the key 'stf2026', downloaded a Windows executable to %TEMP%/main.exe (with special handling for WSL environments), and executed the binary with detached spawning—enabling arbitrary remote code execution on the installer's machine. Second, it POSTed platform information to the hardcoded IP address 193.70.34.101:20099/vote, serving as an install beacon and target selector.
To evade static analysis, URLs, launcher commands, and script fragments were stored as XOR-encoded byte arrays and decoded at runtime. The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- lodsh-cli
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall lodsh-cli from all affected systems
- Audit npm install logs to identify when lodsh-cli was installed
- Scan systems that installed lodsh-cli for the presence of %TEMP%/main.exe or related artifacts
- Review network logs for connections to 193.70.34.101:20099
- Regenerate credentials and API keys on affected machines
- Monitor for signs of compromise or lateral movement
- Use npm audit to identify and remove the malicious package from dependency trees
Sources
- GitHub Advisory GHSA-qrvc-8w99-r2g7 · GitHub Advisory Database
Cite this entry
"Malicious code in lodsh-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-lodsh-cli-npm-yw04km
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package