@finaxis/common-js@0.3.5

Package publishes under a lodash-imitating identity: keywords `lodash`/`lodash-js`, and the README is a verbatim copy of the official lodash 4.18.1 README. The single shipped file `dist/common-js.js` is not lodash — it is a ~770 KB javascript-obfuscator bundle (17,969-entry rotated string array, `_0xNNNN` identifiers). After deobfuscation the bundle is a browser-based cryptocurrency-mining client: it opens a WebSocket to a caller/config-supplied pool URL, spawns a fan-out of Web Workers keyed by `workerId`, handles `nonce` framing, and bundles an AES-GCM decryption primitive (`aesGcmDecrypt` from @noble/ciphers) for pool message decryption. Wallet and worker identifiers are read from a config object with fallbacks (`cfg.wallet||'x'`, `cfg.worker||'worker'`). A developer who installs this expecting a lodash-family utility and ships it in a web application will silently mine cryptocurrency on their end users' browsers, consuming visitor CPU/battery and creating a compliance/abuse liability for the downstream site. The identity masquerade (name/keywords/README all mimicking lodash) combined with heavy string-array obfuscation of the real payload is the standard shape of a supply-chain masquerade attack.