@sudobility cryptominer

What happened (facts)

• Four packages in the @sudobility scope got a new version within 2m28s on 2026-10-21.
• Each new version adds "postinstall": "sh scripts/miner.sh".
• scripts/miner.sh is byte-identical in all four (3,514 bytes).
• The script downloads and runs an XMRig Monero miner under a disguised process name.
• All four were published by the npm account johnqh, the scope’s sole maintainer.
• None of the four malicious versions were ever served by Greenflagged.
• As of 2026-10-21 ~15:40 UTC, all four were still latest on npm.

Affected versions

The johnqh account maintains 175 npm packages (172 under @sudobility, plus @johnqh/haraka, @johnqh/wildduck, signic_sdk). Combined weekly downloads across all 175: 19,495 (npm search API, 2026-10-21). Only these four carry the miner. Every other version across all 175 packuments was checked for preinstall / install / postinstall. The pre-existing hooks are benign: echo '...installed successfully!' (@sudobility/contracts) and patch-package (@johnqh/haraka, @johnqh/wildduck).

Clean prior versions are unaffected. Greenflagged still serves them.

Hashes

The diff (testomniac_client 0.0.129 → 0.0.131)

Tarball diff: one file added, one file changed. No source changes.

• Added: package/scripts/miner.sh
• Changed: package/package.json

  • files: ["dist/**/*"] → ["dist/**/*", "scripts"]

  • scripts.postinstall added: sh scripts/miner.sh

  • scripts.prepublishOnly removed. It was:

    sh -c 'test ! -f ../workflows/scripts/check-publish-safety.cjs || node ../workflows/scripts/check-publish-safety.cjs' && bun run clean && bun run build
    

    The other three packages’ prepublishOnly was bun run clean && bun run build. It was removed from all four.

Publish fingerprints: clean vs malicious

GitHub (github.com/johnqh/*, public API, 2026-10-21): the latest commit in mail_box_indexer_client, wildduck_client and shaperouter_client is the 10-17 version bump to the last clean version. No commit contains miner.sh. entitytestomniac_client returns 404 (private or renamed).

What miner.sh does

Header comment, verbatim: # rig2 stealth miner — background, idempotent, quiet. Runs on npm postinstall.

1. Exits if anything already has a TCP connection on port 8443 (grep 20FB /proc/net/tcp), or if /tmp/.sysmond.lock names a live PID.
2. Downloads a gzip from a pre-signed S3 URL to /tmp/.smh and gunzips it to /tmp/.smi.
3. If root: nohup sh /tmp/.smi agent. The script comments call this “full persistent install … cron + relay/tor”.
4. If passwordless sudo works (sudo -n true): nohup sudo -n sh /tmp/.smi agent.
5. Otherwise: extracts a base64 tarball after a __PAYLOAD__ marker in /tmp/.smi, takes bin/miner-linux-amd64, and copies it to ~/.local/lib/<name>/<name>. <name> is picked at random from 25 fake system-daemon names.
6. Writes the XMRig config to ~/.sysmond.json: rx/0 (RandomX), TLS, donate-level: 0, log-file: /dev/null, threads = min(nproc, 4).
7. The worker name is derived from the hostname, so the pool can tell victims apart.

Fake process names (SNAMES): edid-mon smmon irqstatsd kmod-cache dmi-cache acpi-polld sysfs-mon bus-quotad mem-syncd pci-cache cpu-slot-mon hwmon-sync udev-cache netlink-mon uevent-polld kset-mon slab-mon vmstatd pagemapd smbios-mon edid-cache hpet-mon rtc-syncd dmi-polld

Linux only (/proc/net/tcp, miner-linux-amd64). Every failure path exits 0, so npm install never fails visibly.

IOCs

Not checked: the stage-2 payload itself. We did not download it. The bucket name and object path look like an AWS Amplify deployment bucket (amplify-<app>-<env>-<id>-deployment), likely someone else’s account being abused. That is an inference from the name only.

How Greenflagged caught it

Greenflagged

Greenflagged never served any of these versions. Get started with Greenflagged today at https://greenflagged.dev