ladash-cli is a one-character typosquatting malicious npm package impersonating lodash-cli. Its main entry exports an empty object, but the postinstall.js script runs automatically on npm install, XOR-decoding a hidden URL to download a Windows executable from a GitHub repository unrelated to lodash. The executable is saved to the temporary directory and executed detached with hidden windows on Windows hosts, granting full code execution to the attacker. The script detects WSL environments by inspecting system files and executes a PowerShell bridge command to deliver the payload to the underlying Windows host. It also sends a JSON platform label beacon via HTTP to a suspicious IP address. The payload and commands are XOR-encoded without integrity checks, and the GitHub release tag is suspiciously named 'null'.

Successful installation of ladash-cli version 1.0.0 results in arbitrary code execution on the victim's machine, including Windows hosts and Windows Subsystem for Linux environments. This allows the attacker to run malicious binaries with the privileges of the installing user, potentially leading to full system compromise. The package also leaks installation platform information to a remote server via an unencrypted HTTP request, which could aid attacker reconnaissance.

Avoid installing ladash-cli version 1.0.0. Use the legitimate lodash-cli package instead. Since no official patch or fix is available, users should remove ladash-cli if installed and scan affected systems for the downloaded malicious executable (%TEMP%\main.exe) and any related processes. Monitor for suspicious network connections to the IP 193.70.34.101 on port 20099. Exercise caution with similarly named packages to prevent typosquatting attacks.