{
  "schema_version": "1.6.0",
  "id": "MAL-2026-18130",
  "modified": "2026-10-28T00:00:00Z",
  "published": "2026-10-28T00:00:00Z",
  "summary": "@sudobility/wildduck_client — install-time XMRig cryptominer",
  "details": "npm package @sudobility/wildduck_client@2.3.102 runs a Monero (XMRig) cryptominer from its postinstall hook via a bundled non-JavaScript shell script.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sudobility/wildduck_client"
      },
      "versions": [
        "2.3.102"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3673-sudobility-wildduck-client"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/MAL-2026-18130"
    },
    {
      "type": "ADVISORY",
      "url": "https://osv.dev/vulnerability/MAL-2026-18130"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3673",
    "kind": "malware",
    "class": "Malware · cryptojacking",
    "severity": "High",
    "status": "Malicious package — independently detected",
    "iocs": {
      "ips": [],
      "hashes": [
        "sha256:50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118",
        "sha256:96a607c1f052d9997cf207047fed381b8338a94867a667453bbb8c8806809f8f"
      ],
      "indicators": [
        "Install hook: postinstall: sh scripts/miner.sh",
        "Dropper file: scripts/miner.sh — sha256 50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118",
        "Carrier host (S3): amplify-gursha-dev-121835-deployment.s3.amazonaws.com · object cloud-backend-cache-20261019.gz · AWS key id AKIAUHL4Y2TJZ7L7AE3F",
        "Mining pool: networkservicesupp.flashhub.net:8443 (TLS, RandomX rx/0)",
        "Monero wallet: 49u1mKb1dNoMixgRHt11Ra32D1w4hviUuRDbaJhXFwXUjQP4FiHsSjnDa7XZepDUW1Tx6HhR6gFwWgbuwNxby4UAMiqxieX",
        "Dropped files: $HOME/.sysmond.json (miner config), $HOME/.local/lib/<stealth>/<stealth> (miner binary), /tmp/.sysmond.lock, /tmp/.smh, /tmp/.smi",
        "Runtime indicator: outbound TLS connection to port 8443 (hex 20FB in /proc/net/tcp)"
      ]
    },
    "malicious_files": [
      {
        "path": "scripts/miner.sh",
        "sha256": "50df05975352cfa4558892d0a9ab493744c8ddd40948efa6755bb11dc5050118",
        "role": "XMRig dropper (install-hook target)"
      },
      {
        "path": "wildduck_client-2.3.102.tgz",
        "sha256": "96a607c1f052d9997cf207047fed381b8338a94867a667453bbb8c8806809f8f",
        "role": "package tarball"
      }
    ]
  }
}