Threat Description
Typosquat of the ubiquitous utility library 'lodash'. The malicious package ships a postinstall script that scrapes the user's ~/.npmrc for auth tokens and exfiltrates them to a hardcoded endpoint. Easily installed by a slip of the fingers or a careless copy-paste.
AI Hallucination Analysis
Unlikely AI Hallucination15%
Known to be hallucinated by: n/a (typosquat)
Remediation Guide
- Remove 'lodahs' from your dependencies immediately.
- Replace with the legitimate package 'lodash'.
- Audit imports/usages of the malicious package.
- Check CI/CD logs for when it was introduced.
- Rotate any npm tokens or secrets that may have been exfiltrated.
Quick Facts
- Ecosystem
- npm
- Risk Level
- HIGH
- Type
- typosquat
- Status
- ACTIVE
- Legitimate Package
- lodash
- Hallucination Confidence
- 15%
Check My Project
Scan for this package