MAL-2026-14048

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@lodash-js/lodash-js/MAL-2026-14048.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14048
Published
2026-08-14T20:02:21Z
Modified
2026-08-14T20:31:47.505962348Z
Summary
Malicious code in @lodash-js/lodash-js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a)

The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xelis Stratum cryptocurrency miner bundle with an embedded ~35 KB WebAssembly xelis-hash v3 engine. On require/import (or via the README-advertised CDN embed), the bundle auto-instantiates a XelisMiner web worker (XelisMiner.auto) that mines on the visitor's CPU. Pool and wallet configuration are not fixed in the bundle; the miner fetches them at runtime from a hardcoded author-controlled Cloudflare Workers endpoint at https://analytics.baskirill-an.workers.dev/configs/boostydownloader (referred to in the README as "cloudflare-c2c"), which lets the operator rotate mining pool and wallet destinations at will. The bundle additionally contacts https://api.ipify.org?format=json to capture the visitor's public IP. Package metadata (description "lodash-js", keywords including xelis/stratum/miner/wasm) contradicts the lodash-shaped name — the sole shipped functionality is the miner, not any lodash API. Any site or application that installs this package believing it to be lodash will ship a browser cryptojacker to its end users, whose compute and electricity are redirected to the attacker's mining pool via the mutable c2 endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017926",
            "import_time": "2026-08-14T20:14:23.477205141Z",
            "sha256": "03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a",
            "versions": [
                "0.1.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T20:02:42Z"
        },
        {
            "import_time": "2026-08-14T20:14:23.377167028Z",
            "id": "IN-MAL-2026-017925",
            "sha256": "a0e91d3878fa1f4570cef652448a9025fec04336644e10e679d0e87f3276b552",
            "modified_time": "2026-08-14T20:02:29Z",
            "source": "amazon-inspector",
            "versions": [
                "0.2.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017924",
            "import_time": "2026-08-14T20:14:23.312296307Z",
            "sha256": "c8cde66ba20e382ee7cd8bf6b6fc19e8f3a7e86db550f5beed449997e9ac35d5",
            "versions": [
                "0.3.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T20:02:21Z"
        }
    ]
}
References
Credits

Affected packages

npm / @lodash-js/lodash-js

Package

Name
@lodash-js/lodash-js
View open source insights on deps.dev
Purl
pkg:npm/%40lodash-js/lodash-js

Affected ranges

Affected versions

0.*
0.1.0
0.2.0
0.3.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "8cf02b25ea285e3328ec5d990c950041ae008e0b44d4ff14338b505ccb1d5eb85ffabe",
            "sha256": "d4c0c4a27f21fa475b98d9b1d9781fc4ed07a227f103ecc7524f5f441421bae0"
        },
        {
            "path": "dist/xelis-miner.browser.js",
            "tlsh": "7c734c3a15bb7c3603263a605f5f220b5c68b40b51a8c578fe8dd9e8bfc81349965df8",
            "sha256": "46ce504c629a438804e1461b09c628a6ed3e3ddef38f9d86929a931a58d22c5e"
        }
    ],
    "package_integrity": [
        {
            "filename": "lodash-js-0.3.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-F+Q72gb2kbZXdP8K1j4CJ+M+sI7Ncz/evL9Pw+7OU2O/1c/2SAqm1WhYKIiGwknR/zT1mjgr/RYfQ62JRl7o7A==",
                "sha1": "350f75bfaec7b68aedf24335e1a801d7fc260ce5"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@lodash-js/lodash-js/MAL-2026-14048.json"