MAL-2026-14184 Malicious code in lodsh-cli (npm)
Malicious package
Published
MAL-2026-14184 is a malicious package: lodsh-cli (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-14184/ (Markdown: https://insights.sbomify.com/MAL-2026-14184/index.md)
- Package
- lodsh-cli
- Registry
- npm
What is MAL-2026-14184?
MAL-2026-14184 is a malicious package in lodsh-cli, published on 18 Aug 2026.
Official description
lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it XOR-decodes a hardcoded URL (key 'stf2026') stored as an integer array, downloads a Windows executable to %TEMP%/main.exe (and on WSL runs a decoded PowerShell/cmd bridge command), and spawns the binary detached — arbitrary remote code execution on the installer's machine. Second, it POSTs platform information to a hardcoded bare IP 193.70.34.101:20099/vote, with the host assembled from a string-split array to hide the literal, serving as an install beacon and target selector. URLs, launcher commands, and script fragments are stored as XOR-encoded byte arrays and decoded at runtime to evade static inspection.
What should I do about MAL-2026-14184?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.