OpenSSF/OSV advisory MAL-2026-14064 confirms this npm version as malicious. Package is published with a README copied from lodash v4.18.1 and keywords ['lodash','lodash-js'], but the sole shipped module dist/common-js.js is a heavily obfuscated bundle (javascript-obfuscator with string-array rotation and hex-named identifiers, produced by the package's own scripts.obfuscate build step) implementing a Xelis (XEL) proof-of-work miner...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @finaxis/common-js (npm)
Details
Package is published with a README copied from lodash v4.18.1 and keywords ['lodash','lodash-js'], but the sole shipped module dist/common-js.js is a heavily obfuscated bundle (javascript-obfuscator with string-array rotation and hex-named identifiers, produced by the package's own scripts.obfuscate build step) implementing a Xelis (XEL) proof-of-work miner. The bundle contains a stratum protocol client (stratum:// URLs, mining.ping, mining.set_extranonce, mining.hashrate), a Web Worker mining loop (mineBatch, HASH_BATCH), and an embedded ~46KB base64 WASM payload exporting wasm_xelis_hash_v3 and wasm_mine_batch. Nothing in the shipped code implements a lodash-compatible utility API. Consumers that install this thinking they are getting lodash instead load a covert cryptominer that consumes the host's CPU/GPU on behalf of the attacker's Xelis mining pool.
Decision reason
OpenSSF Malicious Packages via OSV confirms @finaxis/common-js@0.3.4 as malicious (MAL-2026-14064): Malicious code in @finaxis/common-js (npm)