{"answers":{"affected":"1 open source package ship an affected version, including lodsh-cli.","exploited":"There is no known exploitation of MAL-2026-14184 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14184 is a malicious package in lodsh-cli, published on 18 Aug 2026."},"fix_prompt":"MAL-2026-14184 is a malicious package: lodsh-cli (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14184/ (Markdown: https://insights.sbomify.com/MAL-2026-14184/index.md)","id":"MAL-2026-14184","markdown":"https://insights.sbomify.com/MAL-2026-14184/index.md","name":"MAL-2026-14184","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it XOR-decodes a hardcoded URL (key 'stf2026') stored as an integer array, downloads a Windows executable to %TEMP%/main.exe (and on WSL runs a decoded PowerShell/cmd bridge command), and spawns the binary detached — arbitrary remote code execution on the installer's machine. Second, it POSTs platform information to a hardcoded bare IP 193.70.34.101:20099/vote, with the host assembled from a string-split array to hide the literal, serving as an install beacon and target selector. URLs, launcher commands, and script fragments are stored as XOR-encoded byte arrays and decoded at runtime to evade static inspection.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in lodsh-cli (npm)","id":"MAL-2026-14184","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"lodsh-cli","purl":"pkg:npm/lodsh-cli","source":"MAL-2026-14184"}],"products":null,"published":"2026-08-18","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14184/"}