@sudobility/indexer_client

GHSA-2gvv-vgvw-559c

Malicious code in @sudobility/indexer_client (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.146`

## Source: amazon-inspector (b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b)
The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from https://amplify-gursha-dev-121835-deployment.s3.amazonaws.com/ (a presigned S3 URL embedding AWSAccessKeyId <redacted>), decompresses it to /tmp/.smi, and runs it. When executed as root or when passwordless sudo is available, it invokes `/tmp/.smi agent` with elevated privileges to perform a persistent agent install (the script's own comments reference stealth renames, cron, and tor/relay components). In the unprivileged branch it extracts an embedded XMRig binary, writes a hardcoded Monero pool configuration to $HOME/.sysmond.json, copies the binary into $HOME/.local/lib/ under a randomized system-component name drawn from a list including edid-mon, smmon, irqstatsd, and kmod-cache, and launches it via nohup in the background. A second attacker-controlled endpoint networkservicesupp.flashhub.net:8443 is referenced for relay/C2. The S3 URL also exposes a third-party AWS access key as an IOC.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4cf5c2f85ea1249db64cc275e6f1cfef21d6025/osv/malicious/npm/@sudobility/indexer_client/MAL-2026-18127.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4cf5c2f85ea1249db64cc275e6f1cfef21d6025/osv/malicious/npm/@sudobility/indexer_client/MAL-2026-18127.json
- https://www.npmjs.com/package/@sudobility/indexer_client/v/0.0.146
- https://github.com/advisories/GHSA-2gvv-vgvw-559c

Compromised versions (1)

= 0.0.146

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.