@lodash-js/lodash-js (npm) · Malicious Code
Affects @lodash-js/lodash-jsSource GCVE Database
Malicious package : remove @lodash-js/lodash-js and rotate any secrets on hosts that installed it.
Data as of 15 Aug 2026, 15:54 UTC
Malicious package
Published to npm · OSV MAL-2026-14048
What to do
Remove @lodash-js/lodash-js from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@lodash-js/lodash-js | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a) The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xelis Stratum cryptocurrency miner bundle with an embedded ~35 KB WebAssembly xelis-hash v3 engine. On require/import (or via the README-advertised CDN embed), the bundle auto-instantiates a XelisMiner web worker (XelisMiner.auto) that mines on the visitor's CPU. Pool and wallet configuration are not fixed in the bundle; the miner fetches them at runtime from a hardcoded author-controlled Cloudflare Workers endpoint at https://analytics.baskirill-an.workers.dev/configs/boostydownloader (referred to in the README as "cloudflare-c2c"), which lets the operator rotate mining pool and wallet destinations at will. The bundle additionally contacts https://api.ipify.org?format=json to capture the visitor's public IP. Package metadata (description "lodash-js", keywords including xelis/stratum/miner/wasm) contradicts the lodash-shaped name — the sole shipped functionality is the miner, not any lodash API. Any site or application that installs this package believing it to be lodash will ship a browser cryptojacker to its end users, whose compute and electricity are redirected to the attacker's mining pool via the mutable c2 endpoint.