@sudobility/indexer_client@0.0.146

Summary

The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from https://amplify-gursha-dev-121835-deployment.s3.amazonaws.com/ (a presigned S3 URL embedding AWSAccessKeyId <redacted>), decompresses it to /tmp/.smi, and runs it. When executed as root or when passwordless sudo is available, it invokes /tmp/.smi agent with elevated privileges to perform a persistent agent install (the script's own comments reference stealth renames, cron, and tor/relay components). In the unprivileged branch it extracts an embedded XMRig binary, writes a hardcoded Monero pool configuration to $HOME/.sysmond.json, copies the binary into $HOME/.local/lib/ under a randomized system-component name drawn from a list including edid-mon, smmon, irqstatsd, and kmod-cache, and launches it via nohup in the background. A second attacker-controlled endpoint networkservicesupp.flashhub.net:8443 is referenced for relay/C2. The S3 URL also exposes a third-party AWS access key as an IOC.

Source: amazon-inspector (b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b)