registry / Crypto miner / @finaxis/common-js
@finaxis/common-js
common-js
This report shows the evidence for @finaxis/common-js@0.3.10. 8 of 9 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete, auto-starting cryptomining behavior in the published runtime entrypoint, not merely a suspicious primitive. The absence of install hooks does not mitigate runtime harm to browser users.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer imports or serves dist/common-js.js in a browser context.
Impact
Unauthorized CPU consumption and network use on visitors' devices.
Mechanism
Auto-started browser cryptocurrency mining via fetched configuration, WebSockets, and Workers.
Attack narrative
The package disguises a browser cryptocurrency miner as common JavaScript/lodash content. Its published, obfuscated entrypoint exports XelisMiner and automatically invokes its startup path in browser contexts. That path can fetch remote configuration, create workers for computation, and connect through WebSocket, enabling mining activity on machines that load an application bundling this package.
AI rationale
This is concrete, auto-starting cryptomining behavior in the published runtime entrypoint, not merely a suspicious primitive. The absence of install hooks does not mitigate runtime harm to browser users.
Evidence
package.jsondist/common-js.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Published browser entrypoint is a 770KB one-line obfuscated payload that brands itself XelisMiner.
- Importing it in a browser auto-instantiates the miner and invokes its start method.
- The payload fetches a configurable remote configuration, opens WebSockets, and creates Worker instances for computation.
Evidence against
- No preinstall, install, or postinstall hook; the only lifecycle hook is prepublishOnly.
- No Node credential, environment, or local-file harvesting APIs were found in the published entrypoint.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTrivial
NoLicense
Source & flagged code
5 flagged · loading sourcedist/common-js.jsView file
1function a0_0x3e36(){const _0x533fe5=['W4dcNalcMG','CN3cTKe','BdldKCo/','W68mW7RcTG','rSoYm3K','W7viiSkb','WRdcHSkP','i8ocgaq','ehZcI8o1','W41KW4ldVG','WQtcP8oJW7W','usxcUCou','qmk...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/common-js.jsView on unpkg · L11console[_0x43d979(0x110b,'ZI^x')+'r']('[XelisMiner]',_0x30d8cd&&_0x30d8cd[_0x43d979(0x1945,'UqDR')+_0x43d979(0x2cd5,'UqDR')]?_0x30d8cd[_0x43d979(0x1a70,'xa#[')+_0x43d979(0x2e3a,'mg)[')]:_0x30d8cd);
High
Ai Review Evidence
Published browser entrypoint is a 770KB one-line obfuscated payload that brands itself XelisMiner.
dist/common-js.jsView on unpkg · L11var _0xd42e4c=new _0x34bfcf(_0x1c6cf8);_0x34bfcf[_0x34b541(0x1f6d,'b@k7')]=_0xd42e4c,_0xd42e4c[_0x34b541(0x41f0,']p$r')+'t']()[_0x34b541(0x1dc,'N)B$')+'h'](
High
Ai Review Evidence
Importing it in a browser auto-instantiates the miner and invokes its start method.
dist/common-js.jsView on unpkg · L1Findings
5 High2 Medium4 Low
HighObfuscated Payload Loaderdist/common-js.js
HighAi Review Evidencedist/common-js.js
HighAi Review Evidencedist/common-js.js
HighAi Review Evidencedist/common-js.js
HighAi Review Evidencedist/common-js.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @finaxis/common-js@0.3.10.
The versions list below shows the verdict for each recorded version.
- Avoid installing @finaxis/common-js@0.3.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.