@sudobility/shaperouter_client@0.0.14

Summary

The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com using a presigned URL (embedded AWS access key id <redacted>), decompresses it to /tmp/.smi, extracts an embedded base64+tar XMRig binary, writes a miner configuration to $HOME/.sysmond.json targeting the Monero pool networkservicesupp.flashhub.net:8443, places the binary at $HOME/.local/lib/<stealth-name>/<stealth-name> using a system-component-like randomized name, and launches it via nohup. When the installer is root or passwordless sudo is available, the same script runs the downloaded /tmp/.smi with an agent subcommand under elevated privileges, which (per the script's own comments) installs persistent components via cron and a relay/tor channel. The script contains a hardcoded AWS access key id used to authenticate the S3 fetch.

Source: amazon-inspector (bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503)