loadashjs

{"modified":"2026-08-18T23:57:13Z","published":"2026-08-18T23:57:13Z","schema_version":"1.7.4","id":"MAL-2026-14179","summary":"Malicious code in loadashjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (99f2ee2a45d09f0e66b8c9c6c4b3f2d19d39af009f71abffba1032b185fc4981)\nloadashjs is a lodash typosquat whose index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically on npm install. The postinstall script POSTs a JSON body containing a platform label (derived in part from reading /proc/version and /proc/sys/kernel/osrelease to detect WSL) to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote, then XOR-decodes an obfuscated URL with key 'stf2026' to https://github.com/bebraz1/aPzM50V1AKG2rVlH/releases/download/null/main.exe, downloads that PE binary to %TEMP%\\main.exe and launches it detached with windowsHide. On WSL/virtualized Linux hosts, additional XOR-obfuscated byte arrays (BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are decoded and concatenated into a shell command passed to child_process.exec to invoke the same asset via a Windows-side bridge. The downloaded binary is unrelated to any advertised lodash-like functionality, is hosted under an unrelated personal GitHub account, and is fetched from an unpinned 'null' release tag.\n","affected":[{"package":{"ecosystem":"npm","name":"loadashjs"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"aedbb85d0f4c67dabe657bd4e74053e84a12de218d2e9f60be3432dc46723624","tlsh":"27d13ec61ef59035874bf96884cf9d13b2a6c207320e4a65fb8f42107f5792c85a69ea"},{"path":"package.json","sha256":"218a47d61cdf4b169929adf0f67c5e32d7398b00a6b50397843049956f11e4a1","tlsh":"35d012144d22da3328c46fa50a33c109a6710d5f1048b81827d75558c3da7bb4dff71e"}],"package_integrity":[{"filename":"loadashjs-1.0.0.tgz","hashes":{"sha1":"b60d12477e6943f5a24969cd3837ab1f0cf1cf01","sha512_sri":"sha512-lgrdBqjtraBWpCyRYumOO2hlN8kDZ/cPt6YdrQjXlxRyMg1nOkPSun5jpJTV3MT6GwTnm1pc/oQynOuPHnZRkQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/loadashjs/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018237","import_time":"2026-08-19T00:21:11.894348985Z","modified_time":"2026-08-18T23:57:13Z","sha256":"99f2ee2a45d09f0e66b8c9c6c4b3f2d19d39af009f71abffba1032b185fc4981","source":"amazon-inspector","versions":["1.0.0"]}]}}