Malicious code in lodash-lib (npm)

The [email protected] package is a malicious npm typosquatting package that contains no legitimate functionality in its main export but runs a postinstall script. This script XOR-decodes a URL and PowerShell command, sends the installer's platform label to a hardcoded IP endpoint (http://193.70.34.101:20099/vote), downloads an executable from an unrelated GitHub repository (https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe) to the temporary directory, and executes it detached with ignored stdio. On Windows Subsystem for Linux (WSL), it uses a decoded PowerShell command to bridge execution to the Windows host. The executable is unpinned and unsigned, and the package uses misleading naming to disguise its malicious intent.

Installation of [email protected] results in execution of malicious code that can download and run arbitrary binaries on the host system, potentially leading to full system compromise. The postinstall script exfiltrates platform information to a remote server and executes an untrusted executable without verification, increasing risk of malware infection and persistence. The bridging to Windows hosts on WSL environments expands the attack surface to Windows systems.

No official patch or remediation guidance is provided. Users should avoid installing [email protected] as it is a malicious typosquatting package. Verify package authenticity before installation, prefer official lodash packages, and remove any installations of [email protected]. Monitor for unexpected postinstall script activity and network connections to suspicious IP addresses. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.