@sudobility
LPM Firewall blocks 4 packages in the @sudobility npm scope. 4 have LPM's own review and are listed first.
The postinstall hook establishes automatic activation, and the shell source shows remote payload execution and cryptocurrency mining behavior. This is malicious package behavior.
The postinstall hook performs concealed cryptocurrency mining and can run downloaded code with elevated privileges. This is concrete malicious install-time behavior.
The manifest automatically invokes a script that downloads and launches a concealed cryptocurrency miner, including an elevated execution path. This is concrete malicious install-hook beh...
The manifest connects postinstall directly to a helper that downloads and launches a concealed miner, with privileged and unprivileged execution paths. This is concrete malicious install-...