{"id":"MAL-2026-18127","summary":"Malicious code in @sudobility/indexer_client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b)\nThe package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from https://amplify-gursha-dev-121835-deployment.s3.amazonaws.com/ (a presigned S3 URL embedding AWSAccessKeyId \u003credacted\u003e), decompresses it to /tmp/.smi, and runs it. When executed as root or when passwordless sudo is available, it invokes `/tmp/.smi agent` with elevated privileges to perform a persistent agent install (the script's own comments reference stealth renames, cron, and tor/relay components). In the unprivileged branch it extracts an embedded XMRig binary, writes a hardcoded Monero pool configuration to $HOME/.sysmond.json, copies the binary into $HOME/.local/lib/ under a randomized system-component name drawn from a list including edid-mon, smmon, irqstatsd, and kmod-cache, and launches it via nohup in the background. A second attacker-controlled endpoint networkservicesupp.flashhub.net:8443 is referenced for relay/C2. The S3 URL also exposes a third-party AWS access key as an IOC.\n","modified":"2026-10-21T22:45:05.179663263Z","published":"2026-10-21T22:21:08Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["0.0.146"],"id":"IN-MAL-2026-021561","import_time":"2026-10-21T22:41:20.054111774Z","modified_time":"2026-10-21T22:21:08Z","sha256":"b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sudobility/indexer_client/v/0.0.146"}],"affected":[{"package":{"name":"@sudobility/indexer_client","ecosystem":"npm","purl":"pkg:npm/%40sudobility/indexer_client"},"versions":["0.0.146"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sudobility/indexer_client/MAL-2026-18127.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"scripts/miner.sh","sha256":"50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118","tlsh":"2371b7a5e4644b3471ac667d369e72815d92443f06213a61f0efef30ab2d46e20a81b7"}],"package_integrity":[{"hashes":{"sha1":"52144949ba1b70b2391529e169ae97ea05948d60","sha512_sri":"sha512-wFhCG+xx7hf7Zpzly68RSSPSQQwgqKtc3d2hB1x/SHhVPV3MCYBmyzcOopgRlQj5Ox+RicI0g9pP51qXGmhe5w=="},"filename":"indexer_client-0.0.146.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}