registry / @finaxis/common-js / 0.3.9

@finaxis/common-js@0.3.9

common-js

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Importing the browser entrypoint runs an obfuscated Xelis miner startup routine. It fetches dynamic configuration, opens a mining WebSocket, and allocates Web Workers for computation.

Static reason

One or more suspicious static signals were detected.

Trigger

Browser loading or importing dist/common-js.js

Impact

Unconsented CPU use and network participation in a cryptocurrency mining pool.

Mechanism

Obfuscated browser cryptominer with remote configuration and worker-based hashing

Attack narrative

The sole distributed entrypoint is obfuscated and exposed as the package main and browser CDN artifact. Its code labels the exported runtime XelisMiner, immediately executes browser initialization, fetches configuration from a supplied or embedded URL, creates a WebSocket connection, and spawns Web Workers. This is a concrete browser cryptomining chain hidden behind generic common-js/lodash-like metadata.

Rationale

This package is a deceptive, automatically activated browser cryptominer rather than the advertised common utility package. The lack of install hooks does not mitigate the runtime attack.

Evidence

package.jsondist/common-js.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

@finaxis/common-js@0.3.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code