MAL-2026-14048

Dashboard / Malicious Package / MAL-2026-14048

MAL-2026-14048

Summary: Malicious code in @lodash-js/lodash-js (npm)

Details: Source: amazon-inspector (03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a) The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xelis Stratum cryptocurrency miner bundle with an embedded ~35 KB WebAssembly xelis-hash v3 engine. On require/import (or via the README-advertised CDN embed), the bundle auto-instantiates a XelisMiner web worker (XelisMiner.auto) that mines on the visitor's CPU. Pool and wallet configuration are not fixed in the bundle; the miner fetches them at runtime from a hardcoded author-controlled Cloudflare Workers endpoint at https://analytics.baskirill-an.workers.dev/configs/boostydownloader (referred to in the README as "cloudflare-c2c"), which lets the operator rotate mining pool and wallet destinations at will. The bundle additionally contacts https://api.ipify.org?format=json to capture the visitor's public IP. Package metadata (description "lodash-js", keywords including xelis/stratum/miner/wasm) contradicts the lodash-shaped name — the sole shipped functionality is the miner, not any lodash API. Any site or application that installs this package believing it to be lodash will ship a browser cryptojacker to its end users, whose compute and electricity are redirected to the attacker's mining pool via the mutable c2 endpoint.

References: https://www.npmjs.com/package/@lodash-js/lodash-js/v/0.1.0, https://www.npmjs.com/package/@lodash-js/lodash-js/v/0.2.0, https://www.npmjs.com/package/@lodash-js/lodash-js/v/0.3.0