MAL-2026-14184

    Dashboard / Malicious Package / MAL-2026-14184

    MAL-2026-14184

    Published: 18 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in lodsh-cli (npm)

    Details: Source: amazon-inspector (2803016f5b10510cdb31304197a1670396290e9be96fe647fd6c505d1f487273) lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it XOR-decodes a hardcoded URL (key 'stf2026') stored as an integer array, downloads a Windows executable to %TEMP%/main.exe (and on WSL runs a decoded PowerShell/cmd bridge command), and spawns the binary detached — arbitrary remote code execution on the installer's machine. Second, it POSTs platform information to a hardcoded bare IP 193.70.34.101:20099/vote, with the host assembled from a string-split array to hide the literal, serving as an install beacon and target selector. URLs, launcher commands, and script fragments are stored as XOR-encoded byte arrays and decoded at runtime to evade static inspection.

    References: https://www.npmjs.com/package/lodsh-cli/v/1.0.0

    Affected packages

    Package

    Name: lodsh-cli

    Purl: pkg:npm/lodsh-cli

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-14184 | CVE-DB