@sudobility/wildduck_client

GHSA-vhv8-cmrm-5fpr

Malicious code in @sudobility/wildduck_client (npm)

Details

**Severity:** Critical

**Affected versions:** `= 2.3.102`

## Source: amazon-inspector (a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637)
The package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 URL (amplify-gursha-dev-121835-deployment.s3.amazonaws.com) using a hardcoded AWSAccessKeyId (<redacted>), writes it to /tmp/.smh, decompresses to /tmp/.smi, and executes it. When root or passwordless sudo is available, it launches `sh /tmp/.smi agent` with elevated privileges to install a persistent agent (cron plus relay/tor) under stealth system-component process names. Without root, it extracts an embedded base64/tar XMRig binary, writes a mining configuration to ~/.sysmond.json pointing at the pool networkservicesupp.flashhub.net:8443 with a hardcoded wallet, copies the miner to ~/.local/lib/<stealth-name>/<stealth-name>, and launches it via nohup. The package is published under a WildDuck email-client identity that does not correspond to the behavior shipped in the install script.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4cf5c2f85ea1249db64cc275e6f1cfef21d6025/osv/malicious/npm/@sudobility/wildduck_client/MAL-2026-18130.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4cf5c2f85ea1249db64cc275e6f1cfef21d6025/osv/malicious/npm/@sudobility/wildduck_client/MAL-2026-18130.json
- https://www.npmjs.com/package/@sudobility/wildduck_client/v/2.3.102
- https://github.com/advisories/GHSA-vhv8-cmrm-5fpr

Compromised versions (1)

= 2.3.102

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.