The 'lodahs-cli' npm package (version 1.0.0) includes a postinstall lifecycle script that performs multiple malicious actions automatically during installation. It first sends a JSON-formatted platform fingerprint to a hardcoded IP address (http://193.70.34.101:20099/vote) as an install-time beacon. Then, it XOR-decodes a hidden URL pointing to a GitHub repository hosting a malicious executable (main.exe), downloads this executable to the temporary directory, and spawns it detached. Additionally, if the environment is detected as Windows Subsystem for Linux (WSL), it executes a shell command crossing the WSL boundary to run the same executable on the Windows host. The package name is crafted to resemble legitimate packages but is a malicious dropper rather than a functional CLI tool.

This malicious package can compromise systems by executing unauthorized code downloaded from an attacker-controlled GitHub repository. It collects system information and potentially executes malware on both Linux (including WSL) and Windows environments, leading to unauthorized remote code execution and system compromise.

No official patch or remediation is currently documented for this malicious package. Users and administrators should avoid installing 'lodahs-cli' version 1.0.0. Remove the package if already installed and scan affected systems for the downloaded executable and any spawned processes. Monitor for network connections to the indicated IP address and GitHub URL. Use trusted sources and verify package authenticity before installation.