{"answers":{"affected":"1 open source package ship an affected version, including loadashjs.","exploited":"There is no known exploitation of MAL-2026-14179 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14179 is a malicious package in loadashjs, published on 18 Aug 2026."},"fix_prompt":"MAL-2026-14179 is a malicious package: loadashjs (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14179/ (Markdown: https://insights.sbomify.com/MAL-2026-14179/index.md)","id":"MAL-2026-14179","markdown":"https://insights.sbomify.com/MAL-2026-14179/index.md","name":"MAL-2026-14179","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"loadashjs is a lodash typosquat whose index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically on npm install. The postinstall script POSTs a JSON body containing a platform label (derived in part from reading /proc/version and /proc/sys/kernel/osrelease to detect WSL) to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote, then XOR-decodes an obfuscated URL with key 'stf2026' to https://github.com/bebraz1/aPzM50V1AKG2rVlH/releases/download/null/main.exe, downloads that PE binary to %TEMP%\\main.exe and launches it detached with windowsHide. On WSL/virtualized Linux hosts, additional XOR-obfuscated byte arrays (BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are decoded and concatenated into a shell command passed to child_process.exec to invoke the same asset via a Windows-side bridge. The downloaded binary is unrelated to any advertised lodash-like functionality, is hosted under an unrelated personal GitHub account, and is fetched from an unpinned 'null' release tag.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in loadashjs (npm)","id":"MAL-2026-14179","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"loadashjs","purl":"pkg:npm/loadashjs","source":"MAL-2026-14179"}],"products":null,"published":"2026-08-18","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14179/"}