loadashjs is a typosquatting npm package mimicking lodash but containing malicious code. Its index.js exports an empty object, while its postinstall.js script executes automatically on npm install. This script sends a JSON payload with platform information (including detection of WSL) to a hardcoded bare IP endpoint. It then XOR-decodes an obfuscated URL to download a Windows PE binary from a personal GitHub repository under an unpinned 'null' release tag. The binary is saved to the %TEMP% directory as main.exe and executed in a hidden, detached process. On WSL or virtualized Linux environments, additional XOR-obfuscated byte arrays are decoded and concatenated into a shell command to invoke the same Windows payload via a bridging mechanism. The package version 1.0.0 is affected and contains no legitimate lodash functionality, serving solely to deliver and execute malware.

This malicious package can lead to arbitrary code execution on Windows systems where it is installed, as it downloads and runs a hidden executable from an untrusted source. The postinstall script also leaks system platform information to a remote attacker-controlled server. On WSL or virtualized Linux hosts, it uses additional obfuscated scripts to bridge and execute the Windows payload, potentially expanding the attack surface. The package does not provide any legitimate functionality and is designed to compromise the host system.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing loadashjs and similar typosquatting packages. Use verified lodash packages from trusted sources. Monitor npm dependencies for suspicious or unexpected packages. Remove any installations of loadashjs=1.0.0 and scan affected systems for the downloaded malware (main.exe) and related artifacts. Since this is a malicious package, remediation involves removal and incident response rather than patching.