If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619)
lodash-lib@1.0.0 typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm install, the postinstall script XOR-decodes (key 'stf2026') a URL and PowerShell bridge command from integer arrays, POSTs the installer's platform label to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote (host assembled from a string array to avoid literal scanning), then downloads https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe to %TEMP%/main.exe and spawns it detached with stdio ignored. On WSL, a decoded powershell.exe command bridges the download-and-exec to the Windows host. The GitHub repository hosting the binary is unrelated to the package publisher, the URL is unpinned/unversioned, no hash or signature is verified, and cover-story naming ('addon', 'telemetry') is used throughout.