{"id":"MAL-2026-18128","summary":"Malicious code in @sudobility/shaperouter_client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503)\nThe package declares a postinstall hook `sh scripts/miner.sh` that fetches a gzipped payload from `amplify-gursha-dev-121835-deployment.s3.amazonaws.com` using a presigned URL (embedded AWS access key id `\u003credacted\u003e`), decompresses it to `/tmp/.smi`, extracts an embedded base64+tar XMRig binary, writes a miner configuration to `$HOME/.sysmond.json` targeting the Monero pool `networkservicesupp.flashhub.net:8443`, places the binary at `$HOME/.local/lib/\u003cstealth-name\u003e/\u003cstealth-name\u003e` using a system-component-like randomized name, and launches it via `nohup`. When the installer is root or passwordless sudo is available, the same script runs the downloaded `/tmp/.smi` with an `agent` subcommand under elevated privileges, which (per the script's own comments) installs persistent components via cron and a relay/tor channel. The script contains a hardcoded AWS access key id used to authenticate the S3 fetch.\n","modified":"2026-10-21T22:45:05.220247180Z","published":"2026-10-21T22:20:51Z","database_specific":{"malicious-packages-origins":[{"versions":["0.0.14"],"id":"IN-MAL-2026-021559","import_time":"2026-10-21T22:41:19.921728629Z","modified_time":"2026-10-21T22:20:51Z","sha256":"bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sudobility/shaperouter_client/v/0.0.14"}],"affected":[{"package":{"name":"@sudobility/shaperouter_client","ecosystem":"npm","purl":"pkg:npm/%40sudobility/shaperouter_client"},"versions":["0.0.14"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/miner.sh","sha256":"50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118","tlsh":"2371b7a5e4644b3471ac667d369e72815d92443f06213a61f0efef30ab2d46e20a81b7"}],"package_integrity":[{"filename":"shaperouter_client-0.0.14.tgz","hashes":{"sha1":"372f87819798f88dfdd8a18f513e3607315c1910","sha512_sri":"sha512-gPEG7U7CAd/OMI9/GZl0WfBXlZnmisn8hYd0t1+p/Es8GVGIXVXIYSAyMC/YcdYPu5tq8ACSWpSk9b9VeTMzAQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sudobility/shaperouter_client/MAL-2026-18128.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}