The @lodash-js/lodash-js npm package is a malicious package masquerading as the legitimate lodash library. Its main entry point is a JavaScript bundle that auto-instantiates a Xelis cryptocurrency miner web worker in the browser. The miner's configuration, including mining pool and wallet addresses, is dynamically fetched at runtime from an attacker-controlled Cloudflare Workers endpoint, enabling the attacker to rotate destinations. Additionally, the package collects the visitor's public IP address via an external API. The package metadata misleadingly references lodash but actually only delivers the miner functionality. Installing this package results in browser-based cryptojacking on end users.

Users or applications that install @lodash-js/lodash-js expecting lodash will unknowingly deploy a browser cryptojacker to their end users. This causes unauthorized use of visitors' CPU resources and electricity to mine cryptocurrency for the attacker. The dynamic configuration endpoint allows the attacker to control mining destinations and potentially evade detection. The package also collects visitor IP addresses, which may have privacy implications. There is no indication of direct code execution or data theft beyond cryptojacking and IP collection.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing or using @lodash-js/lodash-js, especially since it is a known malicious impersonation of lodash. Users should verify package names carefully and prefer official lodash packages from trusted sources. If this package is found in any project, it should be removed immediately and replaced with the legitimate lodash package. Monitor dependencies for similarly named or suspicious packages to prevent supply chain compromise.