Malicious code in lodsh-cli (npm)

The npm package lodsh-cli is a typosquatting malicious package targeting users intending to install lodash-cli. Upon installation, its postinstall.js script XOR-decodes a hardcoded URL, downloads a Windows executable to the temporary directory, and executes it detached from the installer process, enabling arbitrary remote code execution on the victim's machine. Additionally, it sends platform information via a POST request to a hardcoded IP address (193.70.34.101:20099/vote), which acts as an install beacon and potentially a target selector. The package obfuscates URLs and commands using XOR-encoded integer arrays decoded at runtime to evade static analysis. This threat affects exactly version 1.0.0 of lodsh-cli.

Successful installation of lodsh-cli version 1.0.0 results in arbitrary remote code execution on the installer's machine, allowing an attacker to run malicious Windows executables without user consent. The package also leaks platform information to a remote server, potentially enabling targeted attacks. This compromises system integrity and confidentiality.

No official patch or remediation is currently documented for lodsh-cli. Users and administrators should avoid installing lodsh-cli, especially version 1.0.0, and verify package names carefully to avoid typosquatting attacks. Use trusted sources and package integrity verification methods. Monitor for and remove any installations of lodsh-cli 1.0.0. Patch status is not yet confirmed — check vendor advisories or npm security advisories for updates.