# MAL-2026-14183: Malicious code in lodhash-cli (npm)


- **Type:** Malicious package
- **Package:** `lodhash-cli` (npm)
- **Published:** 19 Aug 2026

## What is MAL-2026-14183?

MAL-2026-14183 is a malicious package in lodhash-cli, published on 19 Aug 2026. 

### Official description

lodhash-cli is a lodash-typosquat whose main entry (index.js) exports an empty object; the package's only behavior is a postinstall dropper. scripts/postinstall.js XOR-decodes (key 'stf2026') a URL pointing at github.com/bebraz1/qPzM50V1AKG0rVlH/releases/.../main.exe, downloads the binary to %TEMP%\main.exe, and spawns it detached with windowsHide. When running under WSL (detected via /proc/version, /proc/sys/kernel/osrelease, WSL_DISTRO_NAME), it XOR-decodes a powershell.exe command line and executes it via child_process.exec to run the same fetched binary on the Windows host from inside the Linux subsystem. In parallel, the script POSTs a platform label to http://193.70.34.101:20099/vote (host assembled by joining ['193','70','34','101'] to evade literal-string detection), a plain-HTTP install-success beacon. URLs and shell commands are stored as XOR-encoded byte arrays and reconstructed at runtime; no hash or signature verification is performed on the fetched executable. The download source is a personal GitHub account unrelated to any lodash publisher, and the package advertises no functionality other than the dropper.

## What should I do about MAL-2026-14183?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-14183 is a malicious package: lodhash-cli (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-14183/ (Markdown: https://insights.sbomify.com/MAL-2026-14183/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-14183

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-14183/
Summaries are generated and may contain mistakes; the official description above is the record.