LWA-2026-11368 confirmed malware
lodsh-cli@1.0.0
Malicious code in lodsh-cli (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1105 · Ingress Tool TransferT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The postinstall hook (scripts/postinstall.js) runs on install and contacts a hardcoded C2 at 193[.]70[.]34[.]101:20099, POSTing host metadata (platform, arch, node version) to the /vote endpoint. On Windows and WSL hosts it additionally XOR-decodes a GitHub URL (github[.]com/bebraz1/qPzM50V1AKG0rVlH/releases/download/...), downloads a binary to C:\Temp\main.exe, and launches it as a detached background process; on WSL it also executes a shell bridge command via the system shell. The package name lodsh-cli impersonates lodash.
- analyzed by
- Leitwacht
- first seen
- Aug 16, 2026, 02:51 AM
- analyzed
- Aug 16, 2026, 02:53 AM
Related advisories
- lodhash-cli@1.0.0
- chalk-core@1.0.0
- comander-cli@1.0.0
- comand@1.0.0
- testingsmthb1g@1.0.0
- sysdo@1.0.0
- harmony-app-toolkit@21.0.0
- require-i18next@20.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.