@finaxis/common-js @0.3.4

Summary

Package is published with a README copied from lodash v4.18.1 and keywords ['lodash','lodash-js'], but the sole shipped module dist/common-js.js is a heavily obfuscated bundle (javascript-obfuscator with string-array rotation and hex-named identifiers, produced by the package's own scripts.obfuscate build step) implementing a Xelis (XEL) proof-of-work miner. The bundle contains a stratum protocol client (stratum:// URLs, mining.ping, mining.set_extranonce, mining.hashrate), a Web Worker mining loop (mineBatch, HASH_BATCH), and an embedded ~46KB base64 WASM payload exporting wasm_xelis_hash_v3 and wasm_mine_batch. Nothing in the shipped code implements a lodash-compatible utility API. Consumers that install this thinking they are getting lodash instead load a covert cryptominer that consumes the host's CPU/GPU on behalf of the attacker's Xelis mining pool.

Source: amazon-inspector (f708a31239d3dc7490906a4a41f5ccb3cb76c99f89bc87b5ad5884939bb2d308)