MAL-2026-14064
Malicious code in @finaxis/common-js (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (f708a31239d3dc7490906a4a41f5ccb3cb76c99f89bc87b5ad5884939bb2d308) Package is published with a README copied from lodash v4.18.1 and keywords ['lodash','lodash-js'], but the sole shipped module dist/common-js.js is a heavily obfuscated bundle (javascript-obfuscator with string-array rotation and hex-named identifiers, produced by the package's own scripts.obfuscate build step) implementing a Xelis (XEL) proof-of-work miner. The bundle contains a stratum protocol client (stratum:// URLs, mining.ping, mining.set_extranonce, mining.hashrate), a Web Worker mining loop (mineBatch, HASH_BATCH), and an embedded ~46KB base64 WASM payload exporting wasm_xelis_hash_v3 and wasm_mine_batch. Nothing in the shipped code implements a lodash-compatible utility API. Consumers that install this thinking they are getting lodash instead load a covert cryptominer that consumes the host's CPU/GPU on behalf of the attacker's Xelis mining pool.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @finaxis/common-js (npm). Pin to a known-safe version or switch to an alternative.