{"answers":{"affected":"1 open source package ship an affected version, including @finaxis/common-js.","exploited":"There is no known exploitation of MAL-2026-14064 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14064 is a malicious package in @finaxis/common-js, published on 15 Aug 2026."},"fix_prompt":"MAL-2026-14064 is a malicious package: @finaxis/common-js (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14064/ (Markdown: https://insights.sbomify.com/MAL-2026-14064/index.md)","id":"MAL-2026-14064","markdown":"https://insights.sbomify.com/MAL-2026-14064/index.md","name":"MAL-2026-14064","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package publishes under a lodash-imitating identity: keywords `lodash`/`lodash-js`, and the README is a verbatim copy of the official lodash 4.18.1 README. The single shipped file `dist/common-js.js` is not lodash — it is a ~770 KB javascript-obfuscator bundle (17,969-entry rotated string array, `_0xNNNN` identifiers). After deobfuscation the bundle is a browser-based cryptocurrency-mining client: it opens a WebSocket to a caller/config-supplied pool URL, spawns a fan-out of Web Workers keyed by `workerId`, handles `nonce` framing, and bundles an AES-GCM decryption primitive (`aesGcmDecrypt` from @noble/ciphers) for pool message decryption. Wallet and worker identifiers are read from a config object with fallbacks (`cfg.wallet||'x'`, `cfg.worker||'worker'`). A developer who installs this expecting a lodash-family utility and ships it in a web application will silently mine cryptocurrency on their end users' browsers, consuming visitor CPU/battery and creating a compliance/abuse liability for the downstream site. The identity masquerade (name/keywords/README all mimicking lodash) combined with heavy string-array obfuscation of the real payload is the standard shape of a supply-chain masquerade attack.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @finaxis/common-js (npm)","id":"MAL-2026-14064","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@finaxis/common-js","purl":"pkg:npm/%40finaxis/common-js","source":"MAL-2026-14064"}],"products":null,"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14064/"}