Malicious code in @404c3s4r/lodash (npm)

The package @404c3s4r/lodash version 9.0.0 is identified as containing malicious code that fully compromises the host computer. Installation or execution of this package can lead to an attacker gaining full control over the system, potentially exposing all stored secrets and keys. The advisory warns that simply removing the package may not eliminate all malicious components, indicating possible persistence mechanisms. The threat is cataloged under MAL-2026-11434 and GHSA-3357-xmhq-8r86, affecting the npm ecosystem. There is no CVSS score available for this threat.

Any system with @404c3s4r/lodash version 9.0.0 installed or running should be considered fully compromised, with potential unauthorized access to all secrets and keys stored on the system. The attacker may have persistent control, making the system untrustworthy even after package removal.

Remove the @404c3s4r/lodash package version 9.0.0 immediately. Rotate all secrets and keys from a different, uncompromised system. Due to the possibility of persistent malicious software, consider a full system reinstallation or forensic analysis to ensure complete remediation.