# MAL-2026-14184: Malicious code in lodsh-cli (npm)


- **Type:** Malicious package
- **Package:** `lodsh-cli` (npm)
- **Published:** 18 Aug 2026

## What is MAL-2026-14184?

MAL-2026-14184 is a malicious package in lodsh-cli, published on 18 Aug 2026. 

### Official description

lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it XOR-decodes a hardcoded URL (key 'stf2026') stored as an integer array, downloads a Windows executable to %TEMP%/main.exe (and on WSL runs a decoded PowerShell/cmd bridge command), and spawns the binary detached — arbitrary remote code execution on the installer's machine. Second, it POSTs platform information to a hardcoded bare IP 193.70.34.101:20099/vote, with the host assembled from a string-split array to hide the literal, serving as an install beacon and target selector. URLs, launcher commands, and script fragments are stored as XOR-encoded byte arrays and decoded at runtime to evade static inspection.

## What should I do about MAL-2026-14184?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-14184 is a malicious package: lodsh-cli (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-14184/ (Markdown: https://insights.sbomify.com/MAL-2026-14184/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-14184

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-14184/
Summaries are generated and may contain mistakes; the official description above is the record.