Malware in @404c3s4r/lodash
Malware was discovered in the npm package @404c3s4r/lodash. Systems with this package installed are considered fully compromised and require immediate remediation.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- @404c3s4r/lodash
A malicious package named @404c3s4r/lodash was published to npm containing malware. Any computer that has this package installed or running should be considered fully compromised.\n\nThe advisory indicates that all secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the compromise.\n\nThis represents a critical supply chain attack through a malicious npm package, likely targeting developers who may have confused it with the legitimate lodash library or who installed it as a dependency.
Indicators of compromise
- Packages
- @404c3s4r/lodash
Remediation
- Immediately isolate any computer that has @404c3s4r/lodash installed from the network
- From a separate, uncompromised computer, rotate all secrets, API keys, credentials, and signing keys that may have been accessible on the compromised system
- Remove the @404c3s4r/lodash package from all systems
- Perform a full security audit and malware scan on affected systems
- Review all recent activity and access logs on compromised systems for signs of unauthorized access
- Consider the compromised system as potentially fully owned by an attacker and plan for complete rebuild if critical infrastructure
Sources
- GitHub Advisory GHSA-3357-xmhq-8r86 · GitHub Advisory Database
Cite this entry
"Malware in @404c3s4r/lodash." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 31, 2026; last updated July 31, 2026. https://supplychainattack.org/incident/malware-in-404c3s4r-lodash-19m9u5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in ai-backup-script
The npm package ai-backup-script contained malware that provided full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in smart-npv-mcp
The npm package smart-npv-mcp contains malware that grants full control of affected systems. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in polyprompt
Malware was discovered in the npm package polyprompt, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in pm-claude-skills-mcp
The npm package pm-claude-skills-mcp contains malware that grants full control of affected systems. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package