Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js masquerades as a lodash utility library but contains obfuscated malicious code that performs browser-based cryptocurrency mining. It establishes WebSocket connections to mining pools and uses Web Workers to mine cryptocurrency on end users' browsers without their consent. This results in unauthorized CPU and battery consumption and potential compliance and abuse liabilities for websites that include this package.
AI Analysis
Technical Summary
The @finaxis/common-js npm package impersonates lodash by copying its README and using lodash-related keywords. However, its main JavaScript file is a heavily obfuscated ~770 KB bundle that implements a browser cryptocurrency miner. The miner connects to a configurable mining pool via WebSocket, spawns multiple Web Workers for mining tasks, and decrypts pool messages using AES-GCM. Wallet and worker IDs are configurable but default to generic values. This supply-chain masquerade attack can cause websites that unknowingly include this package to mine cryptocurrency on visitors' devices silently.
Potential Impact
Users and visitors of web applications that include the affected versions of @finaxis/common-js will experience unauthorized cryptocurrency mining in their browsers. This leads to increased CPU usage, battery drain, degraded device performance, and potential legal or compliance issues for site operators due to abuse of user resources without consent.
Mitigation Recommendations
No official patch or remediation is currently documented. Users and developers should immediately audit their dependencies for the presence of @finaxis/common-js versions =0.3.4, =0.3.5, =0.3.6, =0.3.8, and =0.3.10 and remove or replace this package. Avoid using packages that impersonate well-known libraries and verify package authenticity before inclusion. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.
Malicious code in @finaxis/common-js (npm)
Description
The npm package @finaxis/common-js masquerades as a lodash utility library but contains obfuscated malicious code that performs browser-based cryptocurrency mining. It establishes WebSocket connections to mining pools and uses Web Workers to mine cryptocurrency on end users' browsers without their consent. This results in unauthorized CPU and battery consumption and potential compliance and abuse liabilities for websites that include this package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @finaxis/common-js npm package impersonates lodash by copying its README and using lodash-related keywords. However, its main JavaScript file is a heavily obfuscated ~770 KB bundle that implements a browser cryptocurrency miner. The miner connects to a configurable mining pool via WebSocket, spawns multiple Web Workers for mining tasks, and decrypts pool messages using AES-GCM. Wallet and worker IDs are configurable but default to generic values. This supply-chain masquerade attack can cause websites that unknowingly include this package to mine cryptocurrency on visitors' devices silently.
Potential Impact
Users and visitors of web applications that include the affected versions of @finaxis/common-js will experience unauthorized cryptocurrency mining in their browsers. This leads to increased CPU usage, battery drain, degraded device performance, and potential legal or compliance issues for site operators due to abuse of user resources without consent.
Mitigation Recommendations
No official patch or remediation is currently documented. Users and developers should immediately audit their dependencies for the presence of @finaxis/common-js versions =0.3.4, =0.3.5, =0.3.6, =0.3.8, and =0.3.10 and remove or replace this package. Avoid using packages that impersonate well-known libraries and verify package authenticity before inclusion. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14064
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a84fa65c6e8be0332ef130d
Added to database: 08/19/2026, 00:35:49 UTC
Last enriched: 08/19/2026, 00:50:34 UTC
Last updated: 08/19/2026, 01:19:03 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.