@finaxis/common-js@0.3.3

Analysis

@finaxis/common-js is a trojanized clone of the lodash library: it ships lodash's README verbatim but the actual dist/common-js.js is a 121KB javascript-obfuscator-obfuscated payload (encoded string-array with a custom decoder) rather than lodash source. When loaded, the obfuscated code performs host reconnaissance and issues a DNS TXT lookup to a hardcoded beacon domain as a command-and-control channel. The package impersonates lodash to trick installers into running the obfuscated recon/beacon payload.