GCVE-110-OSM-2026-10496

@finaxis/common-js@0.3.4 contains a hidden, and obfuscated browser-based XELIS cryptojacker. When included in a webpage, the malicious bundle automatically retrieves attacker-controlled mining configuration, discovers the visitor's public IP address, creates Web Workers running an embedded XELIS Hash v3 WebAssembly miner, connects to a remotely configured mining pool, and submits proof-of-work shares for the configured wallet. The miner activates automatically unless the containing script has the data-manual attribute. Its remote configuration can control the wallet, pool or WebSocket endpoint, password, worker identifier, CPU utilization, thread count, and enabled state. CPU usage defaults to 10% but may be remotely increased to 100%. No filesystem persistence, subprocess execution, credential-file access, wallet signing, or direct blockchain transactions were identified. Mining persists within the affected browser page or application context. The malicious payload is contained in dist/common-js.js as an obfuscated JavaScript bundle with an embedded Base64-encoded WebAssembly module identified internally as xelis_hash.wasm. On automatic activation, the bundle requests mining configuration from: https://analytics.stat-4cb.workers.dev/configs/boostydownloader The configuration may be plain JSON or AES-256-GCM-encrypted JSON containing v, iv, and ct fields. Encrypted configuration requires a locally supplied 64-character hexadecimal configKey. If no worker identifier is configured, the malware requests the victim's public IP from: https://api.ipify.org?format=json The public IP is assigned as the mining worker identifier and transmitted to the configured pool during mining.authorize and mining.submit operations. The bundle decodes its embedded WASM in memory, creates a Blob-backed JavaScript Worker, and launches one or more Web Workers. The WASM exports XELIS Hash v3 initialization, hashing, self-test, nonce-batch mining, and found-nonce functions. Workers continuously perform proof-of-work batches, report hashrate statistics, and return successful nonces for pool submission. Mining traffic uses newline-delimited JSON-RPC over WebSockets. Observed methods include mining.subscribe, mining.authorize, mining.hashrate, mining.submit, mining.ping, and mining.pong. The client identifies itself as xelis-stratum-miner-web/0.1.0 and advertises the xel/v3 algorithm. The actual wallet and pool are supplied by remote configuration and are not embedded statically. A constrained retrieval of the default configuration URL on 2026-08-16 returned a direct HTTP 404 response with no redirect. Therefore, no wallet or mining-pool destination was recoverable. The normal execution path does not download a separate mining binary: the WASM miner is embedded. A generic external wasmUrl loader exists inside the worker source, but embedded WASM takes precedence and the automatic initialization path does not supply wasmUrl.