npm · disclosed 21 October 2026
@sudobility npm client packages ship a cryptominer
New versions of four client SDK packages added a postinstall script that downloads and installs an XMRig Monero miner, with persistence when run as root.
- Detectable by a website scanNo, server-side only
- Last reviewed23 October 2026
Affected packages
| Package | Affected versions |
|---|---|
@sudobility/indexer_client | 0.0.146 |
@sudobility/wildduck_client | 2.3.102 |
@sudobility/shaperouter_client | 0.0.14 |
@sudobility/testomniac_client | 0.0.131 |
What to do
- Runs at install time. Check your lockfiles; if any of these versions were installed, treat the machine as compromised.
Sources
We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.