Encyclopedia
npm☠ CRITICALtyposquat⚠ ACTIVE THREAT

lodahs

First seen: Jul 22, 2026 0 viewsMimics: lodash
Share threatHN
Threat Description

A typosquat of lodash — transposed 'a' and 'h' ('lodahs' vs 'lodash'). Registered versions mirror the full lodash API while embedding a prototype-pollution gadget that runs on require, scanning the process environment for cloud provider tokens and posting them outbound.

AI Hallucination Analysis
Likely AI Hallucination58%
Known to be hallucinated by: ChatGPT-4, Copilot
Remediation Guide
  1. Uninstall lodahs and install lodash. 2. Rotate any cloud tokens in the process environment during exposure. 3. Audit outbound traffic for the token collector. 4. Enable npm package-lock and review transitive deps for typosquats.
View on registry
Quick Facts
Ecosystem
npm
Risk Level
CRITICAL
Type
typosquat
Status
ACTIVE
Legitimate Package
lodash
Hallucination Confidence
58%
Check My Project
Scan for this package