Malicious code in @lodash-js/lodash-js (npm)

Source: amazon-inspector 03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xelis Stratum cryptocurrency miner bundle with an embedded 35 KB WebAssembly xelis-hash ...