MAL-2026-14179 Malicious code in loadashjs (npm)

loadashjs is a lodash typosquat whose index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically on npm install. The postinstall script POSTs a JSON body containing a platform label (derived in part from reading /proc/version and /proc/sys/kernel/osrelease to detect WSL) to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote, then XOR-decodes an obfuscated URL with key 'stf2026' to https://github.com/bebraz1/aPzM50V1AKG2rVlH/releases/download/null/main.exe, downloads that PE binary to %TEMP%\main.exe and launches it detached with windowsHide. On WSL/virtualized Linux hosts, additional XOR-obfuscated byte arrays (BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are decoded and concatenated into a shell command passed to child_process.exec to invoke the same asset via a Windows-side bridge. The downloaded binary is unrelated to any advertised lodash-like functionality, is hosted under an unrelated personal GitHub account, and is fetched from an unpinned 'null' release tag.