Malicious package (Typosquatting)
The lodahs package is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.
Advisories for Npm/Lodahs package
2019