{
  "schema_version": "1.6.0",
  "id": "CLR-2026-2995",
  "modified": "2026-07-06T00:00:00Z",
  "published": "2026-07-06T00:00:00Z",
  "summary": "A bulk-mail & credential-cracking toolkit shipped as an npm package",
  "details": "The npm package monotenant@1.0.53 markets itself as \"the only light-speed mailing server on planet earth.\" Its actual purpose is email abuse at scale: it verifies lists of stolen AWS SES, SMTP and Exchange (EWS) credentials, discovers targets via Shodan, and mass-mails through the validated accounts behind rotating proxies and fake identities — reporting results to an operator-controlled Telegram bot. It is not a supply-chain attack on whoever installs it (no install-time theft, no postinstall); it is a weapon the operator runs against third parties. We classify it as Abuse tooling and reported it to npm for takedown.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "monotenant"
      },
      "versions": [
        "1.0.53"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-2995-monotenant"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-2995",
    "kind": "abuse",
    "class": "Abuse tooling",
    "severity": "High",
    "status": "Confirmed abuse tooling",
    "iocs": {
      "ips": [],
      "hashes": [
        "sha256:eac1cb2f291aec7cdbc0b97e590691dd92a2539eb2e41cb53eb5247a22924e08"
      ],
      "indicators": [
        "monotenant (npm) — versions 1.0.53 / 1.0.50 / 1.0.43 / 1.0.42; description \"M!T\"; UNLICENSED",
        "eac1cb2f291aec7cdbc0b97e590691dd92a2539eb2e41cb53eb5247a22924e08 · monotenant-1.0.53.tgz",
        "288/288 JS files hex-obfuscated (whole-package javascript-obfuscator build); cryptic module names (passgo, dnsxt, rhok, whid, aws, lkpt)",
        "AWS SES verify/mail (verifyAwsSesRow, parseAwsTargets, awsSesConcurrency), Shodan target discovery (awsShodanQuery), SMTP/EWS mailer (nodemailer, imapflow, node-ews)",
        "SOCKS/HTTP proxy rotation (socks, socks-proxy-agent), fake identities (@faker-js/faker), results to operator Telegram bot (config.telegram.token/chatId)",
        "Dead homepage https://mntmc.rip + dead repo github.com/oonlyjs/mono; empty author; README claims Apache-2.0/SFC while package.json says UNLICENSED"
      ]
    }
  }
}