MAL-2026-14064 Malicious code in @finaxis/common-js (npm)

Package publishes under a lodash-imitating identity: keywords lodash/lodash-js, and the README is a verbatim copy of the official lodash 4.18.1 README. The single shipped file dist/common-js.js is not lodash — it is a ~770 KB javascript-obfuscator bundle (17,969-entry rotated string array, _0xNNNN identifiers). After deobfuscation the bundle is a browser-based cryptocurrency-mining client: it opens a WebSocket to a caller/config-supplied pool URL, spawns a fan-out of Web Workers keyed by workerId, handles nonce framing, and bundles an AES-GCM decryption primitive (aesGcmDecrypt from @noble/ciphers) for pool message decryption. Wallet and worker identifiers are read from a config object with fallbacks (cfg.wallet||'x', cfg.worker||'worker'). A developer who installs this expecting a lodash-family utility and ships it in a web application will silently mine cryptocurrency on their end users' browsers, consuming visitor CPU/battery and creating a compliance/abuse liability for the downstream site. The identity masquerade (name/keywords/README all mimicking lodash) combined with heavy string-array obfuscation of the real payload is the standard shape of a supply-chain masquerade attack.