@sudobility/shaperouter_client

GHSA-mj95-29f2-vxg2

Malicious code in @sudobility/shaperouter_client (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.14`

## Source: amazon-inspector (bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503)
The package declares a postinstall hook `sh scripts/miner.sh` that fetches a gzipped payload from `amplify-gursha-dev-121835-deployment.s3.amazonaws.com` using a presigned URL (embedded AWS access key id `<redacted>`), decompresses it to `/tmp/.smi`, extracts an embedded base64+tar XMRig binary, writes a miner configuration to `$HOME/.sysmond.json` targeting the Monero pool `networkservicesupp.flashhub.net:8443`, places the binary at `$HOME/.local/lib/<stealth-name>/<stealth-name>` using a system-component-like randomized name, and launches it via `nohup`. When the installer is root or passwordless sudo is available, the same script runs the downloaded `/tmp/.smi` with an `agent` subcommand under elevated privileges, which (per the script's own comments) installs persistent components via cron and a relay/tor channel. The script contains a hardcoded AWS access key id used to authenticate the S3 fetch.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4cf5c2f85ea1249db64cc275e6f1cfef21d6025/osv/malicious/npm/@sudobility/shaperouter_client/MAL-2026-18128.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4cf5c2f85ea1249db64cc275e6f1cfef21d6025/osv/malicious/npm/@sudobility/shaperouter_client/MAL-2026-18128.json
- https://www.npmjs.com/package/@sudobility/shaperouter_client/v/0.0.14
- https://github.com/advisories/GHSA-mj95-29f2-vxg2

Compromised versions (1)

= 0.0.14

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.