lodhash-cli is a malicious npm package designed as a lodash typosquat. Its main module exports nothing functional, but the postinstall script decodes and downloads a binary executable from a non-affiliated GitHub account, saving it to the temporary directory and executing it hidden from the user. When running under WSL, it additionally executes a PowerShell command to run the same binary on the Windows host. The package also sends a plaintext HTTP beacon to a suspicious IP address to signal successful installation. The URLs and commands are XOR-encoded to evade detection. No integrity checks are performed on the downloaded binary, increasing risk. The package advertises no legitimate functionality beyond this dropper behavior.

This malicious package enables arbitrary code execution on the host system by downloading and running an unverified executable. It can run stealthily on both Windows and WSL environments, potentially leading to system compromise. The beaconing behavior may facilitate attacker tracking or command and control. Because the binary is fetched from a personal GitHub repository unrelated to lodash, it is untrusted and could contain any payload. This poses a significant security risk to users who install this package.

Users should avoid installing lodhash-cli version 1.0.0 and remove it if already installed. Since no official patch or fix is available, the best mitigation is to rely on trusted package sources and verify package authenticity before installation. Monitoring for suspicious postinstall behaviors and blocking network connections to the indicated IP address may help detect or prevent infection. Consider using package integrity verification tools and typosquatting detection mechanisms to prevent similar threats.