registry / @finaxis/common-js / 0.3.6

@finaxis/common-js@0.3.6

common-js

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Importing or loading the shipped browser bundle automatically initializes an obfuscated Xelis miner. It creates workers and communicates with dynamically configured network services.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing dist/common-js.js or loading it in a browser/global environment.

Impact

Unauthorized CPU consumption and mining activity in consumer browsers.

Mechanism

Auto-started Xelis cryptocurrency mining via Web Workers and WebSocket.

Attack narrative

The package declares its obfuscated bundle as the main entrypoint. That bundle defines XelisMiner, automatically instantiates and starts it, creates Web Workers for computation, and uses WebSocket/fetch for dynamically supplied mining configuration. This is concrete unauthorized cryptomining behavior, not a benign utility feature.

Rationale

The shipped entrypoint auto-runs an obfuscated Xelis cryptocurrency miner at runtime. The absence of install hooks does not mitigate the malicious import-time/browser execution.

Evidence

package.jsondist/common-js.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Shipped main bundle contains XelisMiner and auto-starts it in a browser/global IIFE.

@finaxis/common-js@0.3.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code