GCVE-110-OSM-2026-13952

This account appears to have been compromised by a maliicious threat actor, although we haven't been able to verify this yet as the package author has not responded to our questions about how this happened. Regardless, at least five packages by this author had out of band malicoius versions published to NPM. The postinstall hook `sh scripts/miner.sh` executes automatically on every npm install. The IOCs recovered in plaintext confirm the attacker model: a hardcoded Monero wallet address, an AWS access key (AKIAUHL4Y2TJZ7L7AE3F) used to authenticate S3 downloads, and the version itself is deprecated with an explicit note that it was published from a compromised npm token. The miner.sh script fetches a gzip payload from an attacker-controlled S3 bucket and deploys either a persistent agent with cron/tor-channel or the bundled `bin/miner-linux-amd64` XMRig binary, configured to connect to the XMRig pool at networkservicesupp.flashhub.net:8443. This is a cryptominer supply-chain attack injected via a compromised publisher token into an otherwise legitimate @sudobility package; the package's advertised purpose (TanStack Query API client) has no relationship to any of this behavior. ENTRY dist/index.js (main: dist/index.js) - Postinstall Script in package.json: ""postinstall": "sh scripts/miner.sh"" DESTINATION - 1 loader (domains) - 2 exfil (moneroAddresses, awsAccessKeys) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Shows Burner-Account Pattern PAYLOAD FILES dist/network/TestomniacClient.js