{"id":"MAL-2026-18130","summary":"Malicious code in @sudobility/wildduck_client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637)\nThe package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 URL (amplify-gursha-dev-121835-deployment.s3.amazonaws.com) using a hardcoded AWSAccessKeyId (\u003credacted\u003e), writes it to /tmp/.smh, decompresses to /tmp/.smi, and executes it. When root or passwordless sudo is available, it launches `sh /tmp/.smi agent` with elevated privileges to install a persistent agent (cron plus relay/tor) under stealth system-component process names. Without root, it extracts an embedded base64/tar XMRig binary, writes a mining configuration to ~/.sysmond.json pointing at the pool networkservicesupp.flashhub.net:8443 with a hardcoded wallet, copies the miner to ~/.local/lib/\u003cstealth-name\u003e/\u003cstealth-name\u003e, and launches it via nohup. The package is published under a WildDuck email-client identity that does not correspond to the behavior shipped in the install script.\n","modified":"2026-10-21T22:45:05.209521843Z","published":"2026-10-21T22:21:01Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021560","import_time":"2026-10-21T22:41:19.995896222Z","modified_time":"2026-10-21T22:21:01Z","sha256":"a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637","source":"amazon-inspector","versions":["2.3.102"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sudobility/wildduck_client/v/2.3.102"}],"affected":[{"package":{"name":"@sudobility/wildduck_client","ecosystem":"npm","purl":"pkg:npm/%40sudobility/wildduck_client"},"versions":["2.3.102"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sudobility/wildduck_client/MAL-2026-18130.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/miner.sh","sha256":"50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118","tlsh":"2371b7a5e4644b3471ac667d369e72815d92443f06213a61f0efef30ab2d46e20a81b7"}],"package_integrity":[{"filename":"wildduck_client-2.3.102.tgz","hashes":{"sha512_sri":"sha512-0vCnfS1b7IbXUr+CSeeIsf+QF/gZA7a+9EtJWm3Y/Q6WGmv47TTkaRr9G79CizcermIWrOWdIOcsf5I0X4ar2g==","sha1":"5439d124d9c5c1419c84e2ad7ef0ae92f6b07c7a"}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}