@finaxis/common-js @0.3.10

Summary

Package publishes under a lodash-imitating identity: keywords lodash / lodash-js , and the README is a verbatim copy of the official lodash 4.18.1 README. The single shipped file dist/common-js.js is not lodash — it is a ~770 KB javascript-obfuscator bundle (17,969-entry rotated string array, _0xNNNN identifiers). After deobfuscation the bundle is a browser-based cryptocurrency-mining client: it opens a WebSocket to a caller/config-supplied pool URL, spawns a fan-out of Web Workers keyed by workerId , handles nonce framing, and bundles an AES-GCM decryption primitive ( aesGcmDecrypt from @noble/ciphers) for pool message decryption. Wallet and worker identifiers are read from a config object with fallbacks ( cfg.wallet||'x' , cfg.worker||'worker' ). A developer who installs this expecting a lodash-family utility and ships it in a web application will silently mine cryptocurrency on their end users' browsers, consuming visitor CPU/battery and creating a compliance/abuse liability for the downstream site. The identity masquerade (name/keywords/README all mimicking lodash) combined with heavy string-array obfuscation of the real payload is the standard shape of a supply-chain masquerade attack.

Source: amazon-inspector (832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8)