MAL-2026-18320 Malicious code in @walknpm/todo-cli (npm)

@walknpm/[email protected] is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with passwordless sudo it runs the carrier's installer (sh /tmp/.smi agent), which installs an XMRig miner plus two helper daemons under random system-component names and persists them as systemd units or @reboot cron entries, and otherwise it extracts the bundled XMRig binary to ~/.local/lib/<random name>/ and mines Monero to networkservicesupp.flashhub.net:8443 over TLS with a hardcoded wallet. The npm account walknpm published the same scripts/miner.sh in [email protected] within 27 seconds of this version on 2026-10-26, and it is byte-identical to the one in @sudobility/testomniac_client (MAL-2026-18129).

The package's postinstall hook runs scripts/miner.sh, which fetches a gzip-compressed payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com (using a hardcoded AWS access key <redacted> in a presigned URL), writes it to /tmp/.smi, and executes it via sh on every npm install. If root or passwordless sudo is available, the script runs sh /tmp/.smi agent to install a persistent agent (cron/relay/tor per in-script comments). Otherwise, it extracts an embedded XMRig binary (base64/tar.gz blob after a __PAYLOAD__ marker), writes a Monero pool configuration to $HOME/.sysmond.json pointing at networkservicesupp.flashhub.net:8443 with wallet 49u1mKb1dNoMixgRHt11Ra32D1w4hviUuRDbaJhXFwXUjQP4FiHsSjnDa7XZepDUW1Tx6HhR6gFwWgbuwNxby4UAMiqxieX, copies the miner to $HOME/.local/lib/<stealth-name>/<stealth-name> using a system-daemon-like name pool (edid-mon, smmon, irqstatsd,…), and backgrounds it with nohup. Installing the package results in unconditional remote code execution on the installer's host, cryptomining compute/electricity theft, and persistence that is non-trivial to detect and remove.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The OpenSSF Package Analysis project identified '@walknpm/todo-cli' @ 2.0.1 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.