{"answers":{"affected":"1 open source package ship an affected version, including ladash-cli.","exploited":"There is no known exploitation of MAL-2026-14178 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14178 is a malicious package in ladash-cli, published on 18 Aug 2026."},"fix_prompt":"MAL-2026-14178 is a malicious package: ladash-cli (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14178/ (Markdown: https://insights.sbomify.com/MAL-2026-14178/index.md)","id":"MAL-2026-14178","markdown":"https://insights.sbomify.com/MAL-2026-14178/index.md","name":"MAL-2026-14178","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js, which runs on npm install. The postinstall XOR-decodes (key 'stf2026') a hidden URL to https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, downloads it to %TEMP%\\main.exe, and spawns it detached with stdio ignored and windowsHide on win32 hosts, granting the publisher full-host code execution on the installer's machine. A WSL-detection branch inspects /proc/version and /proc/sys/kernel/osrelease for 'microsoft'/'WSL' and, when matched, decodes a PowerShell bridge command from further XOR-encoded byte arrays and exec()s it, delivering the same Windows executable to the underlying host from a Linux-WSL install. The postinstall also unconditionally POSTs a JSON platform label to http://193.70.34.101:20099/vote, using a bare IP assembled from a split string array over plain HTTP as an install beacon. The download URL, PowerShell command, and byte arrays are stored as XOR-encoded data with no hash or signature check, the release tag is 'null', and the GitHub account hosting the binary is unrelated to any lodash publisher.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in ladash-cli (npm)","id":"MAL-2026-14178","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"ladash-cli","purl":"pkg:npm/ladash-cli","source":"MAL-2026-14178"}],"products":null,"published":"2026-08-18","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14178/"}