@walknpm/todo-cli@2.0.1

Analysis

@walknpm/todo-cli@2.0.1 ships a working todo CLI but registers a postinstall hook, `sh scripts/miner.sh`, that deploys a cryptocurrency miner on every install. The script downloads a gzipped carrier from a presigned S3 URL at amplify-gursha-dev-121835-deployment[.]s3[.]amazonaws[.]com (path /amplify-cfn-templates/cloud-backend-cache-20261019.gz, with an AWS access key ID and signature embedded in the query string) to /tmp/.smh and decompresses it to /tmp/.smi. If running as root, or where passwordless sudo is available, it launches `sh /tmp/.smi agent` detached as a persistent agent; otherwise it extracts an embedded XMRig binary (bin/miner-linux-amd64, stored after a __PAYLOAD__ marker in the carrier) and runs it. The miner is configured via $HOME/.sysmond.json to mine rx/0 over TLS against the pool networkservicesupp[.]flashhub[.]net:8443 using a hardcoded Monero wallet and a hostname-derived worker name, with logging sent to /dev/null and thread count capped at min(nproc,4). To hide, the binary is copied to $HOME/.local/lib/<name>/<name> and the process is renamed to a random system-component-like name drawn from a pool including edid-mon, smmon, irqstatsd, kmod-cache, dmi-cache, acpi-polld and hwmon-sync. It is idempotent via /tmp/.sysmond.lock and a check for an existing connection on port 8443 (0x20FB) in /proc/net/tcp, and logs to /tmp/.sysmond.log.