{"id":"MAL-2026-18320","kind":"package","aliases":["MAL-2026-18320"],"related":[],"title":"Malicious code in @walknpm/todo-cli (npm)","description":"@walknpm/todo-cli@2.0.1 is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, `sh scripts/miner.sh`, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with passwordless sudo it runs the carrier's installer (`sh /tmp/.smi agent`), which installs an XMRig miner plus two helper daemons under random system-component names and persists them as systemd units or @reboot cron entries, and otherwise it extracts the bundled XMRig binary to ~/.local/lib/<random name>/ and mines Monero to networkservicesupp.flashhub.net:8443 over TLS with a hardcoded wallet. The npm account walknpm published the same scripts/miner.sh in dsh-plugin-blender-3d@0.2.1 within 27 seconds of this version on 2026-10-26, and it is byte-identical to the one in @sudobility/testomniac_client (MAL-2026-18129).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f32e42bc70458d6a0973dfbe2d94961cca2ee423198c53bf753a7680c61df96f)\nThe package's `postinstall` hook runs `scripts/miner.sh`, which fetches a gzip-compressed payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com (using a hardcoded AWS access key <redacted> in a presigned URL), writes it to `/tmp/.smi`, and executes it via `sh` on every `npm install`. If root or passwordless sudo is available, the script runs `sh /tmp/.smi agent` to install a persistent agent (cron/relay/tor per in-script comments). Otherwise, it extracts an embedded XMRig binary (base64/tar.gz blob after a `__PAYLOAD__` marker), writes a Monero pool configuration to `$HOME/.sysmond.json` pointing at networkservicesupp.flashhub.net:8443 with wallet 49u1mKb1dNoMixgRHt11Ra32D1w4hviUuRDbaJhXFwXUjQP4FiHsSjnDa7XZepDUW1Tx6HhR6gFwWgbuwNxby4UAMiqxieX, copies the miner to `$HOME/.local/lib/<stealth-name>/<stealth-name>` using a system-daemon-like name pool (`edid-mon`, `smmon`, `irqstatsd`,...), and backgrounds it with `nohup`. Installing the package results in unconditional remote code execution on the installer's host, cryptomining compute/electricity theft, and persistence that is non-trivial to detect and remove.\n\n## Source: ossf-package-analysis (8c741f8bd0012bceb8789b8e2fc0ac836c5ccb88a348918365af4850f1576be4)\nThe OpenSSF Package Analysis project identified '@walknpm/todo-cli' @ 2.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@walknpm/todo-cli","fixed":[],"affected":"= 2.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T00:55:57+00:00","first_seen_at":"2026-10-26T20:51:53+00:00","triaged_at":"2026-10-26T20:53:36+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':140C '-18129':155C '-18320':8A,11A '-2026':7A,10A,154C '-26':141C '/.local/lib':105C '/tmp/.smh':55C '/tmp/.smi':69C,199C,220C '0.2.1':131C '2.0.0':34C '2.0.1':16C,323C '2026':139C '27':133C '3d':130C '49u1mkb1dnomixgrht11ra32d1w4hviuurdbajhxfwxujqp4fihssjnda7xzepduw1tx6hhr6gfwwgbuwnxby4uamiqxiex':258C '8c741f8bd0012bceb8789b8e2fc0ac836c5ccb88a348918365af4850f1576be4':315C 'access':190C 'account':119C 'agent':70C,221C,226C 'amazon':167C 'amazon-inspector':166C 'amplify-gursha-dev-121835-deployment.s3.amazonaws.com':53C,185C 'analysi':314C,319C 'app':29C 'associ':339C 'avail':215C 'aw':189C 'background':278C 'base64/tar.gz':240C 'behavior':342C 'binari':103C,239C 'blender':129C 'blob':241C 'bundl':101C 'byte':146C 'byte-ident':145C 'carrier':51C,65C 'chang':32C 'cli':26C 'code':2A,289C 'command':338C 'comment':232C 'compon':84C 'compress':182C 'compute/electricity':297C 'configur':250C 'consid':329C 'copi':259C 'cron':94C 'cron/relay/tor':227C 'cryptomin':296C 'daemon':79C,268C 'detail':158C 'detect':307C 'download':48C 'dsh':127C 'dsh-plugin-blender-3d':126C 'edid':273C 'edid-mon':272C 'edit':161C 'embed':237C 'entri':95C 'everi':206C 'execut':201C,290C,334C 'extract':99C,235C 'f32e42bc70458d6a0973dfbe2d94961cca2ee423198c53bf753a7680c61df96f':169C 'fetch':178C 'gzip':50C,181C 'gzip-compress':180C 'hardcod':115C,188C 'helper':78C 'home/.local/lib':263C 'home/.sysmond.json':252C 'hook':174C 'host':295C 'ident':147C 'identifi':321C 'in-script':229C 'inspector':168C 'instal':45C,67C,72C,208C,223C,282C,293C 'irqstatsd':276C 'key':191C 'like':269C 'line':164C 'list':25C 'mal':6A,9A,153C 'malici':1A,13B,326C,330C,341C 'marker':245C 'mine':107C 'miner':75C,261C 'mon':274C 'monero':108C,248C 'name':85C,270C 'networkservicesupp.flashhub.net:8443':110C,255C 'new':19C 'nohup':281C 'non':304C 'non-trivi':303C 'npm':5A,44C,118C,207C,324C 'one':150C,335C 'openssf':317C 'ossf':312C 'ossf-package-analysi':311C 'otherwis':97C,233C 'packag':14B,171C,284C,313C,318C,333C 'passwordless':60C,212C 'payload':183C,244C 'per':156C,228C 'persist':87C,225C,300C 'plugin':128C 'plus':76C 'point':253C 'pool':249C,271C 'postinstal':37C,173C 'presign':194C 'project':320C 'publish':121C 'random':81C 'reboot':93C 'releas':20C 'remot':288C 'remov':309C 'result':285C 'root':57C,210C 'run':42C,63C,175C,218C 'script':38C,47C,217C,231C 'scripts/miner.sh':40C,124C,176C 'second':134C 'sh':39C,68C,204C,219C 'smmon':275C 'sourc':157C,165C,310C 'sudo':61C,213C 'sudobility/testomniac_client':152C 'system':83C,267C 'system-compon':82C 'system-daemon-lik':266C 'systemd':90C 'theft':298C 'tls':112C 'todo':24C 'todo-list':23C 'trivial':305C 'two':77C 'uncondit':287C 'unit':91C 'url':195C 'use':186C,264C 'version':137C 'via':203C 'walknpm':120C 'walknpm/todo-cli':4A,12A,15C,322C 'wallet':116C,257C 'web':28C 'whose':30C 'within':132C 'write':196C,246C 'xmrig':74C,102C,238C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T00:55:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18320","url":"https://osv.dev/vulnerability/MAL-2026-18320","severity":"critical","published_at":"2026-10-26T00:55:57+00:00","modified_at":"2026-10-26T06:45:15+00:00","first_seen_at":"2026-10-26T20:51:53+00:00","fetched_at":"2026-10-26T20:51:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}