MAL-2026-14180

Dashboard / Malicious Package / MAL-2026-14180

MAL-2026-14180

Summary: Malicious code in lodahs-cli (npm)

Details: Source: amazon-inspector (15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914) The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. First, it POSTs a platform fingerprint as JSON to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote (host assembled from a split array to hide the literal), acting as an install-time beacon. Second, it XOR-decodes (key 'stf2026') a hidden URL that resolves to https://github.com/beb1raz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe — an unrelated personal GitHub account with an obfuscated repository name — downloads main.exe to %TEMP%, and spawns it detached. Third, when /proc/version indicates WSL, installAddonViaBridge() concatenates additional XOR-decoded segments into a shell command passed to child_process.exec with windowsHide:true, crossing the WSL boundary to fetch and execute the same.exe on the Windows host. The package name resembles a reversal of 'shadol'/'lodash' but the shipped code is a dropper rather than any CLI; there are no source files matching the advertised purpose.

References: https://www.npmjs.com/package/lodahs-cli/v/1.0.0