Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
- Disclosed
- Last updated
- Blast radius
- All consumers of @finaxis/common-js who installed it expecting lodash functionality
- Ecosystems
- Attack vectors
- Affected entities
- @finaxis/common-jsnpm package masquerading as lodash
The @finaxis/common-js npm package was published with deceptive metadata designed to impersonate the popular lodash library. The package's README and keywords were copied directly from lodash v4.18.1, creating the false impression that it provided lodash utility functions.
However, the actual shipped module (dist/common-js.js) was a heavily obfuscated JavaScript bundle produced by javascript-obfuscator with string-array rotation and hex-named identifiers. Rather than implementing any lodash-compatible API, the bundle contained a complete Xelis (XEL) proof-of-work miner with stratum protocol client support, Web Worker mining loops, and an embedded ~46KB base64-encoded WASM payload exporting wasm_xelis_hash_v3 and wasm_mine_batch functions.
Developers who installed @finaxis/common-js expecting lodash functionality would instead load code that silently consumes the host's CPU and GPU resources to mine Xelis cryptocurrency on behalf of the attacker's mining pool. The obfuscation and deceptive packaging made the malicious intent difficult to detect without detailed code analysis.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- @finaxis/common-js
Remediation
- Immediately uninstall @finaxis/common-js from all projects and systems
- Audit npm package.json files and lock files for any dependency on @finaxis/common-js
- Replace any usage with the legitimate lodash package (npm install lodash)
- Review system resource usage (CPU/GPU) during the period the malicious package was installed
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Monitor npm registry for similar typosquatting or impersonation attempts targeting popular packages
Sources
- GitHub Advisory GHSA-cxv6-5ffv-7w2g · GitHub Advisory Database
Cite this entry
"Malicious code in @finaxis/common-js (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-finaxis-common-js-npm-18g3bw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package