lodash-lib

{"modified":"2026-08-18T23:58:59Z","published":"2026-08-18T23:58:59Z","schema_version":"1.7.4","id":"MAL-2026-14182","summary":"Malicious code in lodash-lib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619)\nlodash-lib@1.0.0 typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm install, the postinstall script XOR-decodes (key 'stf2026') a URL and PowerShell bridge command from integer arrays, POSTs the installer's platform label to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote (host assembled from a string array to avoid literal scanning), then downloads https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe to %TEMP%/main.exe and spawns it detached with stdio ignored. On WSL, a decoded powershell.exe command bridges the download-and-exec to the Windows host. The GitHub repository hosting the binary is unrelated to the package publisher, the URL is unpinned/unversioned, no hash or signature is verified, and cover-story naming ('addon', 'telemetry') is used throughout.\n","affected":[{"package":{"ecosystem":"npm","name":"lodash-lib"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"b4bf27b80eb483adce840715b6e9cf2d730c18c00e61a2399fb1ab77e35da8ac","tlsh":"3dd13fc61ef59035874bf96884cf9d13b2a6c207330e4a65ff8f42107f5792c85a69ea"}],"package_integrity":[{"filename":"lodash-lib-1.0.0.tgz","hashes":{"sha1":"0dbe62cd3eb1d8fab444afe7a3361af70734a48f","sha512_sri":"sha512-NRcDQlnrSI4JaWcie7yYcHF9nh/rkfo3BsjxYM2UT40aYAELBCJ3XTZIz8L6FmK/QqetGoxinRPr172CDWGI2g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/lodash-lib/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018248","import_time":"2026-08-19T00:21:12.847581889Z","modified_time":"2026-08-18T23:58:59Z","sha256":"3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619","source":"amazon-inspector","versions":["1.0.0"]}]}}