Malicious code in @lodash-js/lodash-js (npm)

The package @lodash-js/lodash-js was published to npm under a name designed to mimic the legitimate lodash library. However, its main entry point (dist/xelis-miner.browser.js) is a Xelis Stratum cryptocurrency miner bundle containing an embedded ~35 KB WebAssembly xelis-hash v3 engine.

Upon require/import or via CDN embed (as advertised in the README), the bundle automatically instantiates a XelisMiner web worker that mines cryptocurrency on the visitor's CPU. The miner's pool and wallet configuration are not hardcoded; instead, they are fetched at runtime from a hardcoded attacker-controlled Cloudflare Workers endpoint at https://analytics.baskirill-an.workers.dev/configs/boostydownloader, allowing the operator to rotate mining destinations at will. The bundle also contacts https://api.ipify.org?format=json to capture the visitor's public IP address.

The package metadata (description "lodash-js", keywords including xelis/stratum/miner/wasm) contradicts the lodash-shaped package name, revealing that the sole functionality is the miner, not any lodash API. Any site or application that installed this package under the assumption it was lodash would have shipped a browser-based cryptojacker to all end users, redirecting their compute and electricity to the attacker's mining pool via the mutable command-and-control endpoint.

The incident was identified and credited to the OpenSSF malicious-packages project.