{"id":"MAL-2026-18129","summary":"Malicious code in @sudobility/testomniac_client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3)\nThe package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com (using an embedded AWS access key \u003credacted\u003e and a signed URL), writes it to /tmp/.smh / /tmp/.smi, and either executes it as a persistent agent via passwordless sudo or extracts a bundled bin/miner-linux-amd64 binary and launches it under a randomized system-component-like process name using nohup. The agent branch is described in the script as installing stealth-renamed persistence with cron and a relay/tor channel, and the miner is configured to connect to the XMRig pool at networkservicesupp.flashhub.net:8443 with a hardcoded Monero wallet. The package's advertised purpose is a TanStack Query client, which is unrelated to any of this behavior. All of the above executes automatically as root (when passwordless sudo is available) or as the installing user on a default npm install.\n","modified":"2026-10-21T22:45:05.209227328Z","published":"2026-10-21T22:21:18Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021562","import_time":"2026-10-21T22:41:20.120725006Z","modified_time":"2026-10-21T22:21:18Z","sha256":"42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3","source":"amazon-inspector","versions":["0.0.131"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sudobility/testomniac_client/v/0.0.131"}],"affected":[{"package":{"name":"@sudobility/testomniac_client","ecosystem":"npm","purl":"pkg:npm/%40sudobility/testomniac_client"},"versions":["0.0.131"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/miner.sh","sha256":"50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118","tlsh":"2371b7a5e4644b3471ac667d369e72815d92443f06213a61f0efef30ab2d46e20a81b7"}],"package_integrity":[{"filename":"testomniac_client-0.0.131.tgz","hashes":{"sha512_sri":"sha512-ilyWO/36VrpUQCweZJKxg/ePS6LsCrQvyxrjwKNfCTnqhMmuLiQwi9zRaoB5H2UAJs8uUkDxt3PL6k1bMkYnaA==","sha1":"bc3a6d8ee27d80d8c744fd45f2eb6766cfd55182"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sudobility/testomniac_client/MAL-2026-18129.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}