MAL-2026-14179

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/loadashjs/MAL-2026-14179.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14179
Published
2026-08-18T23:57:13Z
Modified
2026-08-19T00:30:15.911765963Z
Summary
Malicious code in loadashjs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (99f2ee2a45d09f0e66b8c9c6c4b3f2d19d39af009f71abffba1032b185fc4981)

loadashjs is a lodash typosquat whose index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically on npm install. The postinstall script POSTs a JSON body containing a platform label (derived in part from reading /proc/version and /proc/sys/kernel/osrelease to detect WSL) to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote, then XOR-decodes an obfuscated URL with key 'stf2026' to https://github.com/bebraz1/aPzM50V1AKG2rVlH/releases/download/null/main.exe, downloads that PE binary to %TEMP%\main.exe and launches it detached with windowsHide. On WSL/virtualized Linux hosts, additional XOR-obfuscated byte arrays (BRIDGELAUNCHERENC, BRIDGESCRIPTPREENC, BRIDGESCRIPTPOSTENC) are decoded and concatenated into a shell command passed to child_process.exec to invoke the same asset via a Windows-side bridge. The downloaded binary is unrelated to any advertised lodash-like functionality, is hosted under an unrelated personal GitHub account, and is fetched from an unpinned 'null' release tag.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:11.894348985Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-18T23:57:13Z",
            "sha256": "99f2ee2a45d09f0e66b8c9c6c4b3f2d19d39af009f71abffba1032b185fc4981",
            "id": "IN-MAL-2026-018237",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / loadashjs

Package

Name
loadashjs
View open source insights on deps.dev
Purl
pkg:npm/loadashjs

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/loadashjs/MAL-2026-14179.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "aedbb85d0f4c67dabe657bd4e74053e84a12de218d2e9f60be3432dc46723624",
            "path": "scripts/postinstall.js",
            "tlsh": "27d13ec61ef59035874bf96884cf9d13b2a6c207320e4a65fb8f42107f5792c85a69ea"
        },
        {
            "sha256": "218a47d61cdf4b169929adf0f67c5e32d7398b00a6b50397843049956f11e4a1",
            "tlsh": "35d012144d22da3328c46fa50a33c109a6710d5f1048b81827d75558c3da7bb4dff71e",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "loadashjs-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-lgrdBqjtraBWpCyRYumOO2hlN8kDZ/cPt6YdrQjXlxRyMg1nOkPSun5jpJTV3MT6GwTnm1pc/oQynOuPHnZRkQ==",
                "sha1": "b60d12477e6943f5a24969cd3837ab1f0cf1cf01"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]