lodhash-cli@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) of lodhash-cli fingerprints the host (platform, architecture, Node version, WSL detection) and POSTs the platform label to 193[.]70[.]34[.]101:20099/vote. On Windows and WSL it decodes an XOR-obfuscated URL and downloads a native binary main.exe from hxxps://github[.]com/bebrazi1/qzM50V1AKG0rVlH/releases/download/null/main[.]exe into the TEMP directory, then launches it as a detached background process; on WSL it additionally runs a decoded bridge script via exec. The package is a typosquat of lodash with no declared functionality.