Threat Description
A typosquat of the lodash utility library (extra trailing 's'), published by the same author as the electorn and loadyaml typosquat campaign documented by Sonatype in 2020. The package impersonated lodash to deliver an information-stealing payload and was later removed.
AI Hallucination Analysis
Unlikely AI Hallucination0%
Known to be hallucinated by: None - this is a real typosquat, not an AI hallucination.
Remediation Guide
- Remove lodashs and install the legitimate lodash. 2. Review what data the environment exposed. 3. Audit for typosquatted names. 4. Pin dependencies by hash.
Quick Facts
- Ecosystem
- npm
- Risk Level
- HIGH
- Type
- typosquat
- Status
- ACTIVE
- Legitimate Package
- lodash
- Hallucination Confidence
- 0%
Check My Project
Scan for this package