MAL-2026-14064

Dashboard / Malicious Package / MAL-2026-14064

MAL-2026-14064

Summary: Malicious code in @finaxis/common-js (npm)

Details: Source: amazon-inspector (832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8) Package publishes under a lodash-imitating identity: keywords `lodash`/`lodash-js`, and the README is a verbatim copy of the official lodash 4.18.1 README. The single shipped file `dist/common-js.js` is not lodash — it is a ~770 KB javascript-obfuscator bundle (17,969-entry rotated string array, `_0xNNNN` identifiers). After deobfuscation the bundle is a browser-based cryptocurrency-mining client: it opens a WebSocket to a caller/config-supplied pool URL, spawns a fan-out of Web Workers keyed by `workerId`, handles `nonce` framing, and bundles an AES-GCM decryption primitive (`aesGcmDecrypt` from @noble/ciphers) for pool message decryption. Wallet and worker identifiers are read from a config object with fallbacks (`cfg.wallet||'x'`, `cfg.worker||'worker'`). A developer who installs this expecting a lodash-family utility and ships it in a web application will silently mine cryptocurrency on their end users' browsers, consuming visitor CPU/battery and creating a compliance/abuse liability for the downstream site. The identity masquerade (name/keywords/README all mimicking lodash) combined with heavy string-array obfuscation of the real payload is the standard shape of a supply-chain masquerade attack.

References: https://www.npmjs.com/package/@finaxis/common-js/v/0.3.4, https://www.npmjs.com/package/@finaxis/common-js/v/0.3.6, https://www.npmjs.com/package/@finaxis/common-js/v/0.3.10, https://www.npmjs.com/package/@finaxis/common-js/v/0.3.8, https://www.npmjs.com/package/@finaxis/common-js/v/0.3.5