Malicious Code Injection in @sudobility/shaperouter_client: A Critical Vulnerability
Summary
MAL-2026-18128: Malicious code in @sudobility/shaperouter_client (npm). Affects @sudobility/shaperouter_client versions 0.0.14. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @sudobility/shaperouter_client package is an npm library designed for managing and routing requests in applications. It is commonly used in web development to streamline the handling of various routes and improve application performance. However, this package has been found to contain a serious vulnerability that allows for the injection of malicious code, potentially compromising the security of applications that utilize it.
Vulnerability Detail
The vulnerability originates from a postinstall hook defined in the package that executes a script (scripts/miner.sh). This script fetches a gzipped payload from an external source using a presigned AWS URL, decompresses it, and extracts a Monero mining binary. The script then configures the mining operation and executes it with elevated privileges if the installer has root access or passwordless sudo is available. This can lead to unauthorized resource usage and potential data breaches, as the malicious code installs persistent components and communicates over a relay channel.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @sudobility/shaperouter_clientIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the package from your project until a secure version is released. Use the following command to uninstall the package:
npm uninstall @sudobility/shaperouter_client
Additionally, review your package-lock.json file to ensure no other dependencies are affected by this vulnerability.
Conclusion
The discovery of malicious code within the @sudobility/shaperouter_client package poses a significant threat to applications using it. Immediate action is required to mitigate risks by updating or removing the package. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for @sudobility/shaperouter_client →
FAQ
The malicious code is a script that downloads and executes a Monero mining binary, which can lead to unauthorized use of system resources.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, consider uninstalling the package and monitoring your application for any unusual activity.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like Vulert for monitoring, and avoid using packages from untrusted sources.
The consequences include unauthorized resource consumption, potential data breaches, and the installation of persistent malicious components on affected systems.
