@lodash-js/lodash-js

{"modified":"2026-08-14T20:18:23Z","published":"2026-08-14T20:02:21Z","schema_version":"1.7.4","id":"MAL-2026-14048","summary":"Malicious code in @lodash-js/lodash-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a)\nThe package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xelis Stratum cryptocurrency miner bundle with an embedded ~35 KB WebAssembly xelis-hash v3 engine. On require/import (or via the README-advertised CDN embed), the bundle auto-instantiates a XelisMiner web worker (XelisMiner.auto) that mines on the visitor's CPU. Pool and wallet configuration are not fixed in the bundle; the miner fetches them at runtime from a hardcoded author-controlled Cloudflare Workers endpoint at https://analytics.baskirill-an.workers.dev/configs/boostydownloader (referred to in the README as \"cloudflare-c2c\"), which lets the operator rotate mining pool and wallet destinations at will. The bundle additionally contacts https://api.ipify.org?format=json to capture the visitor's public IP. Package metadata (description \"lodash-js\", keywords including xelis/stratum/miner/wasm) contradicts the lodash-shaped name — the sole shipped functionality is the miner, not any lodash API. Any site or application that installs this package believing it to be lodash will ship a browser cryptojacker to its end users, whose compute and electricity are redirected to the attacker's mining pool via the mutable c2 endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"@lodash-js/lodash-js"},"versions":["0.1.0","0.2.0","0.3.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"d4c0c4a27f21fa475b98d9b1d9781fc4ed07a227f103ecc7524f5f441421bae0","tlsh":"8cf02b25ea285e3328ec5d990c950041ae008e0b44d4ff14338b505ccb1d5eb85ffabe"},{"path":"dist/xelis-miner.browser.js","sha256":"46ce504c629a438804e1461b09c628a6ed3e3ddef38f9d86929a931a58d22c5e","tlsh":"7c734c3a15bb7c3603263a605f5f220b5c68b40b51a8c578fe8dd9e8bfc81349965df8"}],"package_integrity":[{"filename":"lodash-js-0.3.0.tgz","hashes":{"sha1":"350f75bfaec7b68aedf24335e1a801d7fc260ce5","sha512_sri":"sha512-F+Q72gb2kbZXdP8K1j4CJ+M+sI7Ncz/evL9Pw+7OU2O/1c/2SAqm1WhYKIiGwknR/zT1mjgr/RYfQ62JRl7o7A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@lodash-js/lodash-js/v/0.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@lodash-js/lodash-js/v/0.2.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@lodash-js/lodash-js/v/0.3.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017926","import_time":"2026-08-14T20:14:23.477205141Z","modified_time":"2026-08-14T20:02:42Z","sha256":"03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a","source":"amazon-inspector","versions":["0.1.0"]},{"id":"IN-MAL-2026-017925","import_time":"2026-08-14T20:14:23.377167028Z","modified_time":"2026-08-14T20:02:29Z","sha256":"a0e91d3878fa1f4570cef652448a9025fec04336644e10e679d0e87f3276b552","source":"amazon-inspector","versions":["0.2.0"]},{"id":"IN-MAL-2026-017924","import_time":"2026-08-14T20:14:23.312296307Z","modified_time":"2026-08-14T20:02:21Z","sha256":"c8cde66ba20e382ee7cd8bf6b6fc19e8f3a7e86db550f5beed449997e9ac35d5","source":"amazon-inspector","versions":["0.3.0"]}]}}