Malicious code in lodahsjs (npm)

The 'lodahsjs' npm package (version 1.0.0) is a malicious typosquatting package that mimics the popular 'lodash' package but contains no legitimate exports. Its postinstall.js script executes upon installation and performs two main malicious actions: it sends platform-specific information (including WSL and Linux kernel details) to a hardcoded IP address (http://193.70.34.101:20099/vote), and it downloads an XOR-obfuscated Windows executable from a GitHub release URL (https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe). This executable is saved to the user's temporary directory and launched detached on Windows. On WSL hosts, the script constructs and executes an obfuscated PowerShell command to run the same payload on the Windows side. The package is purely malicious with the intent to select victims and deploy an alien Windows executable from an unrelated personal GitHub account.

Installation of this package results in execution of malicious code that exfiltrates system information to a remote server and downloads and runs a potentially harmful Windows executable. This can lead to compromise of the affected system, unauthorized data disclosure, and persistence of malicious software. The package does not provide any legitimate functionality, indicating its sole purpose is malicious payload delivery.

Since this is a malicious typosquat package, the primary mitigation is to avoid installing 'lodahsjs' and verify package names carefully before installation. There is no official patch or fix because this is not a legitimate package but a malicious actor's artifact. Users and organizations should audit their dependencies to detect and remove this package if present. Use trusted package sources and consider implementing package integrity verification mechanisms. Monitor for and block network connections to the identified C2 IP (193.70.34.101) and the GitHub URL used for payload delivery.