{
  "schema_version": "1.6.0",
  "id": "MAL-2026-18128",
  "modified": "2026-10-28T00:00:00Z",
  "published": "2026-10-28T00:00:00Z",
  "summary": "@sudobility/shaperouter_client — install-time XMRig cryptominer",
  "details": "npm package @sudobility/shaperouter_client@0.0.14 runs a Monero (XMRig) cryptominer from its postinstall hook via a bundled non-JavaScript shell script.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sudobility/shaperouter_client"
      },
      "versions": [
        "0.0.14"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3671-sudobility-shaperouter-client"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/MAL-2026-18128"
    },
    {
      "type": "ADVISORY",
      "url": "https://osv.dev/vulnerability/MAL-2026-18128"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3671",
    "kind": "malware",
    "class": "Malware · cryptojacking",
    "severity": "High",
    "status": "Malicious package — independently detected",
    "iocs": {
      "ips": [],
      "hashes": [
        "sha256:50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118",
        "sha256:867649018b2ed3cf1ccfa9071d98b490693983f82f437aa8e01cd40798b7cf4c"
      ],
      "indicators": [
        "Install hook: postinstall: sh scripts/miner.sh",
        "Dropper file: scripts/miner.sh — sha256 50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118",
        "Carrier host (S3): amplify-gursha-dev-121835-deployment.s3.amazonaws.com · object cloud-backend-cache-20261019.gz · AWS key id AKIAUHL4Y2TJZ7L7AE3F",
        "Mining pool: networkservicesupp.flashhub.net:8443 (TLS, RandomX rx/0)",
        "Monero wallet: 49u1mKb1dNoMixgRHt11Ra32D1w4hviUuRDbaJhXFwXUjQP4FiHsSjnDa7XZepDUW1Tx6HhR6gFwWgbuwNxby4UAMiqxieX",
        "Dropped files: $HOME/.sysmond.json (miner config), $HOME/.local/lib/<stealth>/<stealth> (miner binary), /tmp/.sysmond.lock, /tmp/.smh, /tmp/.smi",
        "Runtime indicator: outbound TLS connection to port 8443 (hex 20FB in /proc/net/tcp)"
      ]
    },
    "malicious_files": [
      {
        "path": "scripts/miner.sh",
        "sha256": "50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118",
        "role": "XMRig dropper (install-hook target)"
      },
      {
        "path": "shaperouter_client-0.0.14.tgz",
        "sha256": "867649018b2ed3cf1ccfa9071d98b490693983f82f437aa8e01cd40798b7cf4c",
        "role": "package tarball"
      }
    ]
  }
}