lodahsjs@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) sends a host-fingerprint JSON body ({"platform":...}) to 193[.]70[.]34[.]101:20099/vote over HTTP. On Windows/WSL hosts it additionally downloads a second-stage binary from hxxps://github[.]com/beabraz1/qPzM50V1AKG0rVlH/releases/download/null/main[.]exe into %TEMP%\main.exe and launches it as a detached background process (or runs a bridge command via exec), executing a remote payload on the installer's machine.