MAL-2026-18128

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sudobility/shaperouter_client/MAL-2026-18128.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-18128

Published

2026-10-21T22:20:51Z

Modified

2026-10-21T22:45:05Z

Summary

Malicious code in @sudobility/shaperouter_client (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503)

The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com using a presigned URL (embedded AWS access key id <redacted>), decompresses it to /tmp/.smi, extracts an embedded base64+tar XMRig binary, writes a miner configuration to $HOME/.sysmond.json targeting the Monero pool networkservicesupp.flashhub.net:8443, places the binary at $HOME/.local/lib/<stealth-name>/<stealth-name> using a system-component-like randomized name, and launches it via nohup. When the installer is root or passwordless sudo is available, the same script runs the downloaded /tmp/.smi with an agent subcommand under elevated privileges, which (per the script's own comments) installs persistent components via cron and a relay/tor channel. The script contains a hardcoded AWS access key id used to authenticate the S3 fetch.

Database specific

{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021559",
            "import_time":  "2026-10-21T22:41:19.921728629Z",
            "modified_time":  "2026-10-21T22:20:51Z",
            "sha256":  "bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.14"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/@sudobility/shaperouter_client/v/0.0.14

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / @sudobility/shaperouter_client

Package

Name: @sudobility/shaperouter_client; View open source insights on deps.dev
Purl: pkg:npm/%40sudobility/shaperouter_client

Affected ranges

Affected versions

0.*

0.0.14

Database specific

cwes

[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files":  [
        {
            "path":  "scripts/miner.sh",
            "sha256":  "50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118",
            "tlsh":  "2371b7a5e4644b3471ac667d369e72815d92443f06213a61f0efef30ab2d46e20a81b7"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "shaperouter_client-0.0.14.tgz",
            "hashes":  {
                "sha1":  "372f87819798f88dfdd8a18f513e3607315c1910",
                "sha512_sri":  "sha512-gPEG7U7CAd/OMI9/GZl0WfBXlZnmisn8hYd0t1+p/Es8GVGIXVXIYSAyMC/YcdYPu5tq8ACSWpSk9b9VeTMzAQ=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sudobility/shaperouter_client/MAL-2026-18128.json"