lodahsjs

{"modified":"2026-08-18T23:56:04Z","published":"2026-08-18T23:56:04Z","schema_version":"1.7.4","id":"MAL-2026-14181","summary":"Malicious code in lodahsjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318)\nPackage name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two hostile actions. First, it POSTs a platform label (including a WSL/virtualized-Linux probe reading /proc/version and /proc/sys/kernel/osrelease) to a hardcoded bare-IP C2 assembled from an array of octets: http://193.70.34.101:20099/vote. Second, an XOR-obfuscated URL (byte array ADDON_ENC decoded with key 'stf2026') resolves to https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe; the script downloads that binary to %TEMP%\\main.exe and spawns it detached on Windows, and on WSL hosts assembles an XOR-decoded PowerShell command (BRIDGE_LAUNCHER_ENC/BRIDGE_SCRIPT_PRE_ENC/BRIDGE_SCRIPT_POST_ENC) passed to child_process.exec with windowsHide:true to fetch and run the same binary on the Windows side. The package has no legitimate functionality; the postinstall script's only purpose is to select victims and land an alien Windows executable from an unrelated personal GitHub account.\n","affected":[{"package":{"ecosystem":"npm","name":"lodahsjs"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"598c439186fead299d8715586aeeaad9cf200c715cc7d7848c66be6e36990915","tlsh":"edd13fc61ef59035874bf96884cf9d13b2a6c207330e4a65ff8f42107f5792c85a69ea"}],"package_integrity":[{"filename":"lodahsjs-1.0.0.tgz","hashes":{"sha1":"c5ba6a69a32f656820ed95d6a4c4dc1a65415374","sha512_sri":"sha512-KXl4kPuN/OmAlVVR0mdAncHMIJoN64VXQdp7mtUxqR+ucgPtPRvEXtzTBeLb5prTM5+ME6Kb6lIDUMrXDRvAtA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/lodahsjs/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018229","import_time":"2026-08-19T00:21:11.036111872Z","modified_time":"2026-08-18T23:56:04Z","sha256":"6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318","source":"amazon-inspector","versions":["1.0.0"]}]}}