MAL-2026-14182

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lodash-lib/MAL-2026-14182.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14182
Published
2026-08-18T23:58:59Z
Modified
2026-08-19T00:30:13.210082146Z
Summary
Malicious code in lodash-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619)

lodash-lib@1.0.0 typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm install, the postinstall script XOR-decodes (key 'stf2026') a URL and PowerShell bridge command from integer arrays, POSTs the installer's platform label to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote (host assembled from a string array to avoid literal scanning), then downloads https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe to %TEMP%/main.exe and spawns it detached with stdio ignored. On WSL, a decoded powershell.exe command bridges the download-and-exec to the Windows host. The GitHub repository hosting the binary is unrelated to the package publisher, the URL is unpinned/unversioned, no hash or signature is verified, and cover-story naming ('addon', 'telemetry') is used throughout.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:12.847581889Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-18T23:58:59Z",
            "sha256": "3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619",
            "id": "IN-MAL-2026-018248",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / lodash-lib

Package

Name
lodash-lib
View open source insights on deps.dev
Purl
pkg:npm/lodash-lib

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lodash-lib/MAL-2026-14182.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "b4bf27b80eb483adce840715b6e9cf2d730c18c00e61a2399fb1ab77e35da8ac",
            "tlsh": "3dd13fc61ef59035874bf96884cf9d13b2a6c207330e4a65ff8f42107f5792c85a69ea",
            "path": "scripts/postinstall.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "lodash-lib-1.0.0.tgz",
            "hashes": {
                "sha1": "0dbe62cd3eb1d8fab444afe7a3361af70734a48f",
                "sha512_sri": "sha512-NRcDQlnrSI4JaWcie7yYcHF9nh/rkfo3BsjxYM2UT40aYAELBCJ3XTZIz8L6FmK/QqetGoxinRPr172CDWGI2g=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]