MAL-2026-14181 Malicious code in lodahsjs (npm)

Package name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two hostile actions. First, it POSTs a platform label (including a WSL/virtualized-Linux probe reading /proc/version and /proc/sys/kernel/osrelease) to a hardcoded bare-IP C2 assembled from an array of octets: http://193.70.34.101:20099/vote. Second, an XOR-obfuscated URL (byte array ADDON_ENC decoded with key 'stf2026') resolves to https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe; the script downloads that binary to %TEMP%\main.exe and spawns it detached on Windows, and on WSL hosts assembles an XOR-decoded PowerShell command (BRIDGE_LAUNCHER_ENC/BRIDGE_SCRIPT_PRE_ENC/BRIDGE_SCRIPT_POST_ENC) passed to child_process.exec with windowsHide:true to fetch and run the same binary on the Windows side. The package has no legitimate functionality; the postinstall script's only purpose is to select victims and land an alien Windows executable from an unrelated personal GitHub account.