MAL-2026-14178

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ladash-cli/MAL-2026-14178.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14178
Published
2026-08-18T23:57:06Z
Modified
2026-08-19T00:30:14Z
Summary
Malicious code in ladash-cli (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb)

ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js, which runs on npm install. The postinstall XOR-decodes (key 'stf2026') a hidden URL to https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, downloads it to %TEMP%\main.exe, and spawns it detached with stdio ignored and windowsHide on win32 hosts, granting the publisher full-host code execution on the installer's machine. A WSL-detection branch inspects /proc/version and /proc/sys/kernel/osrelease for 'microsoft'/'WSL' and, when matched, decodes a PowerShell bridge command from further XOR-encoded byte arrays and exec()s it, delivering the same Windows executable to the underlying host from a Linux-WSL install. The postinstall also unconditionally POSTs a JSON platform label to http://193.70.34.101:20099/vote, using a bare IP assembled from a split string array over plain HTTP as an install beacon. The download URL, PowerShell command, and byte arrays are stored as XOR-encoded data with no hash or signature check, the release tag is 'null', and the GitHub account hosting the binary is unrelated to any lodash publisher.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018236",
            "import_time": "2026-08-19T00:21:11.799835869Z",
            "modified_time": "2026-08-18T23:57:06Z",
            "sha256": "8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ladash-cli

Package

Name
ladash-cli
View open source insights on deps.dev
Purl
pkg:npm/ladash-cli

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.js",
            "sha256": "4cadbfdde5a1dcb34c92a196c300bc618448942b12224543eb73522749de1c9c",
            "tlsh": "5ad13fca1ef59035874bf96884cf9d13b2a6c207320d4a65ff8f42107f5793c85a69e9"
        },
        {
            "path": "package.json",
            "sha256": "52622e8f692d211c74c0eae2f3f675281fa0c5433afd167895868c76fa7e4a18",
            "tlsh": "dbd012144e319a3338c46ba50a63c209a6714d5f1148f81827e7559883da7b75dfe71e"
        }
    ],
    "package_integrity": [
        {
            "filename": "ladash-cli-1.0.0.tgz",
            "hashes": {
                "sha1": "ad374ca8d79a7181e0152b42ad05a8fdfe3e74ec",
                "sha512_sri": "sha512-cCYKPbFmmlXDUpX7TS/rHIYPTRWeWsKK4YJw/Fe3Fj5qGh7ZvpUX/gHrGs1x7MzCZbTXO1cIkPqirJbotPwcbQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ladash-cli/MAL-2026-14178.json"