@sudobility/testomniac_client@0.0.131

Summary

The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com (using an embedded AWS access key <redacted> and a signed URL), writes it to /tmp/.smh / /tmp/.smi, and either executes it as a persistent agent via passwordless sudo or extracts a bundled bin/miner-linux-amd64 binary and launches it under a randomized system-component-like process name using nohup. The agent branch is described in the script as installing stealth-renamed persistence with cron and a relay/tor channel, and the miner is configured to connect to the XMRig pool at networkservicesupp.flashhub.net:8443 with a hardcoded Monero wallet. The package's advertised purpose is a TanStack Query client, which is unrelated to any of this behavior. All of the above executes automatically as root (when passwordless sudo is available) or as the installing user on a default npm install.

Source: amazon-inspector (42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3)