@sudobility/indexer_client@0.0.146

Analysis

@sudobility/indexer_client@0.0.146 ships a postinstall hook (`sh scripts/miner.sh`) that installs a stealth cryptocurrency miner and, when privileged, a persistent second-stage agent. The script: checks /proc/net/tcp for an existing connection on port 8443 and a /tmp/.sysmond.lock PID lock to stay idempotent; downloads a gzipped carrier from a presigned S3 URL at amplify-gursha-dev-121835-deployment[.]s3[.]amazonaws[.]com/amplify-cfn-templates/cloud-backend-cache-20261019.gz to /tmp/.smh and gunzips it to /tmp/.smi; if running as root or with passwordless sudo, launches `sh /tmp/.smi agent` detached via nohup (logging to /tmp/.sysmond.log); otherwise extracts a base64/tar payload after a __PAYLOAD__ marker and runs bin/miner-linux-amd64 as XMRig. It writes an XMRig config to $HOME/.sysmond.json with pool networkservicesupp[.]flashhub[.]net:8443 (algo rx/0, TLS, keepalive), Monero wallet 49u1mKb1dNoMixgRHt11Ra32D1w4hviUuRDbaJhXFwXUjQP4FiHsSjnDa7XZepDUW1Tx6HhR6gFwWgbuwNxby4UAMiqxieX, a hostname-derived worker name and min(nproc,4) threads, with logging to /dev/null. To hide, the binary is copied to $HOME/.local/lib/<name>/<name> under a randomly chosen system-component-like name (edid-mon, irqstatsd, kmod-cache, dmi-cache, acpi-polld, sysfs-mon, …) and started with nohup. The package's dist/ code is an ordinary React client library; the miner is delivered solely through the install hook.