registry / @finaxis/common-js / 0.3.8

@finaxis/common-js@0.3.8

common-js

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Importing the browser entry auto-initializes an obfuscated Xelis miner. It retrieves configuration, connects over WebSocket, and launches Workers for computation.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer loads or imports dist/common-js.js in a browser document.

Impact

Unauthorized use of visitor CPU and network resources for cryptocurrency mining.

Mechanism

Obfuscated browser cryptominer with remote configuration and worker execution.

Attack narrative

The package presents itself as common/lodash-like code but its declared browser entry embeds an obfuscated XelisMiner. When loaded in a document, the payload auto-creates a miner instance and invokes its start-like method. Its implementation fetches configuration, opens WebSocket connections, and creates Workers, enabling remote-directed browser mining without a user action or clear package purpose.

Rationale

The runtime entry contains an automatically invoked, obfuscated Xelis mining payload with remote configuration, WebSocket, and Worker execution. This is concrete unauthorized cryptomining behavior, not a package-aligned utility.

Evidence

package.jsondist/common-js.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

@finaxis/common-js@0.3.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code