Malicious code in @finaxis/common-js (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8) Package publishes under a lodash-imitating identity: keywords `lodash`/`lodash-js`, and the README is a verbatim copy of the official lodash 4.18.1 README. The single shipped file `dist/common-js.js` is not lodash — it is a ~770 KB javascript-obfuscator bundle (17,969-entry rotated string array, `_0xNNNN` identifiers). After deobfuscation the bundle is a browser-based cryptocurrency-mining client: it opens a WebSocket to a caller/config-supplied pool URL, spawns a fan-out of Web Workers keyed by `workerId`, handles `nonce` framing, and bundles an AES-GCM decryption primitive (`aesGcmDecrypt` from @noble/ciphers) for pool message decryption. Wallet and worker identifiers are read from a config object with fallbacks (`cfg.wallet||'x'`, `cfg.worker||'worker'`). A developer who installs this expecting a lodash-family utility and ships it in a web application will silently mine cryptocurrency on their end users' browsers, consuming visitor CPU/battery and creating a compliance/abuse liability for the downstream site. The identity masquerade (name/keywords/README all mimicking lodash) combined with heavy string-array obfuscation of the real payload is the standard shape of a supply-chain masquerade attack.
AI Analysis
Technical Summary
The @finaxis/common-js npm package impersonates lodash by copying its README and using lodash-related keywords. However, its main JavaScript file is a heavily obfuscated ~770 KB bundle that implements a browser cryptocurrency miner. The miner connects to a configurable mining pool via WebSocket, spawns multiple Web Workers for mining tasks, and decrypts pool messages using AES-GCM. Wallet and worker IDs are configurable but default to generic values. This supply-chain masquerade attack can cause websites that unknowingly include this package to mine cryptocurrency on visitors' devices silently.
Potential Impact
Users and visitors of web applications that include the affected versions of @finaxis/common-js will experience unauthorized cryptocurrency mining in their browsers. This leads to increased CPU usage, battery drain, degraded device performance, and potential legal or compliance issues for site operators due to abuse of user resources without consent.
Mitigation Recommendations
No official patch or remediation is currently documented. Users and developers should immediately audit their dependencies for the presence of @finaxis/common-js versions =0.3.4, =0.3.5, =0.3.6, =0.3.8, and =0.3.10 and remove or replace this package. Avoid using packages that impersonate well-known libraries and verify package authenticity before inclusion. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.
Malicious code in @finaxis/common-js (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8) Package publishes under a lodash-imitating identity: keywords `lodash`/`lodash-js`, and the README is a verbatim copy of the official lodash 4.18.1 README. The single shipped file `dist/common-js.js` is not lodash — it is a ~770 KB javascript-obfuscator bundle (17,969-entry rotated string array, `_0xNNNN` identifiers). After deobfuscation the bundle is a browser-based cryptocurrency-mining client: it opens a WebSocket to a caller/config-supplied pool URL, spawns a fan-out of Web Workers keyed by `workerId`, handles `nonce` framing, and bundles an AES-GCM decryption primitive (`aesGcmDecrypt` from @noble/ciphers) for pool message decryption. Wallet and worker identifiers are read from a config object with fallbacks (`cfg.wallet||'x'`, `cfg.worker||'worker'`). A developer who installs this expecting a lodash-family utility and ships it in a web application will silently mine cryptocurrency on their end users' browsers, consuming visitor CPU/battery and creating a compliance/abuse liability for the downstream site. The identity masquerade (name/keywords/README all mimicking lodash) combined with heavy string-array obfuscation of the real payload is the standard shape of a supply-chain masquerade attack.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @finaxis/common-js npm package impersonates lodash by copying its README and using lodash-related keywords. However, its main JavaScript file is a heavily obfuscated ~770 KB bundle that implements a browser cryptocurrency miner. The miner connects to a configurable mining pool via WebSocket, spawns multiple Web Workers for mining tasks, and decrypts pool messages using AES-GCM. Wallet and worker IDs are configurable but default to generic values. This supply-chain masquerade attack can cause websites that unknowingly include this package to mine cryptocurrency on visitors' devices silently.
Potential Impact
Users and visitors of web applications that include the affected versions of @finaxis/common-js will experience unauthorized cryptocurrency mining in their browsers. This leads to increased CPU usage, battery drain, degraded device performance, and potential legal or compliance issues for site operators due to abuse of user resources without consent.
Mitigation Recommendations
No official patch or remediation is currently documented. Users and developers should immediately audit their dependencies for the presence of @finaxis/common-js versions =0.3.4, =0.3.5, =0.3.6, =0.3.8, and =0.3.10 and remove or replace this package. Avoid using packages that impersonate well-known libraries and verify package authenticity before inclusion. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14064
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a84fa65c6e8be0332ef130d
Added to database: 08/19/2026, 00:35:49 UTC
Last enriched: 08/19/2026, 00:50:34 UTC
Last updated: 10/02/2026, 14:54:11 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.