MAL-2026-14178

Dashboard / Malicious Package / MAL-2026-14178

MAL-2026-14178

Summary: Malicious code in ladash-cli (npm)

Details: Source: amazon-inspector (8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb) ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js, which runs on npm install. The postinstall XOR-decodes (key 'stf2026') a hidden URL to https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, downloads it to %TEMP%\main.exe, and spawns it detached with stdio ignored and windowsHide on win32 hosts, granting the publisher full-host code execution on the installer's machine. A WSL-detection branch inspects /proc/version and /proc/sys/kernel/osrelease for 'microsoft'/'WSL' and, when matched, decodes a PowerShell bridge command from further XOR-encoded byte arrays and exec()s it, delivering the same Windows executable to the underlying host from a Linux-WSL install. The postinstall also unconditionally POSTs a JSON platform label to http://193.70.34.101:20099/vote, using a bare IP assembled from a split string array over plain HTTP as an install beacon. The download URL, PowerShell command, and byte arrays are stored as XOR-encoded data with no hash or signature check, the release tag is 'null', and the GitHub account hosting the binary is unrelated to any lodash publisher.

References: https://www.npmjs.com/package/ladash-cli/v/1.0.0