@sudobility/testomniac_client

Details

**Severity:** Critical

**Affected versions:** `= 0.0.131`

## Source: amazon-inspector (42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3)
The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com (using an embedded AWS access key <redacted> and a signed URL), writes it to /tmp/.smh / /tmp/.smi, and either executes it as a persistent agent via passwordless sudo or extracts a bundled bin/miner-linux-amd64 binary and launches it under a randomized system-component-like process name using nohup. The agent branch is described in the script as installing stealth-renamed persistence with cron and a relay/tor channel, and the miner is configured to connect to the XMRig pool at networkservicesupp.flashhub.net:8443 with a hardcoded Monero wallet. The package's advertised purpose is a TanStack Query client, which is unrelated to any of this behavior. All of the above executes automatically as root (when passwordless sudo is available) or as the installing user on a default npm install.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4cf5c2f85ea1249db64cc275e6f1cfef21d6025/osv/malicious/npm/@sudobility/testomniac_client/MAL-2026-18129.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4cf5c2f85ea1249db64cc275e6f1cfef21d6025/osv/malicious/npm/@sudobility/testomniac_client/MAL-2026-18129.json
- https://www.npmjs.com/package/@sudobility/testomniac_client/v/0.0.131
- https://github.com/advisories/GHSA-58jf-66x8-7q28

Compromised versions (1)

• = 0.0.131

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.