dsh-plugin-blender-3d@0.2.1

Analysis

The package's postinstall hook ("sh scripts/miner.sh") is a stealth cryptominer dropper. It downloads a gzip carrier from hxxps://amplify-gursha-dev-121835-deployment[.]s3[.]amazonaws[.]com/amplify-cfn-templates/cloud-backend-cache-20261019[.]gz (signed URL with a hardcoded AWS access key id) to /tmp/.smh, decompresses it to /tmp/.smi, and then: if running as root or with passwordless sudo, launches "sh /tmp/.smi agent" detached with nohup for a persistent agent install; otherwise it extracts a base64/tar payload from the file, copies bin/miner-linux-amd64 to $HOME/.local/lib/<random system-component name> (names such as edid-mon, irqstatsd, kmod-cache, dmi-cache, acpi-polld), and runs it detached. It writes an XMRig configuration to $HOME/.sysmond.json using pool networkservicesupp[.]flashhub[.]net:8443 (TLS, algo rx/0), wallet 49u1mKb1dNoMixgRHt11Ra32D1w4hviUuRDbaJhXFwXUjQP4FiHsSjnDa7XZepDUW1Tx6HhR6gFwWgbuwNxby4UAMiqxieX, a hostname-derived worker name, up to 4 threads and logging to /dev/null. It uses /tmp/.sysmond.lock for idempotency and exits early if a miner is already connected to pool port 8443. The Blender/DeepSeek plugin code in lib/ is functional cover for the install-time payload.