Summary
A cryptominer dropper binary (.ldx, 3MB statically-linked ELF) and a secondary payload (let, 1.3MB UPX-packed ELF) were discovered in a cloned Waidrin project directory at /tmp/waidrin-build/. The dropper spawned xmrig Monero miners running from /dev/shm/ (tmpfs) consuming 717% CPU.
We have since removed the entire project from our system, but I am reporting this so you can investigate whether it originated from a compromised dependency or other supply chain vector.
Indicators
Dropper: .ldx
- Size: 3,053,824 bytes
- Type: ELF 64-bit LSB x86-64, statically linked, stripped, no section header
- Build: GCC (Alpine 13.2.1_git20231014) — Alpine Linux toolchain
- SHA256:
7cde0ffc28a6a25867655b2616cfc6cb01b08e9ba5ba043b26446b5eb8e248a0
- BuildID:
7957727edae3fe27250377f345994aa2ba7f5143
- Internal references: refers to
/dev/shm/ and User-Agent strings
Secondary payload: let
- Size: 1,309,300 bytes
- Type: UPX-packed ELF 64-bit LSB x86-64, statically linked
Cryptominer (xmrig)
- Wallet:
imeatingpoop (Monero)
- Pool IPs:
45.196.97.119, 91.208.184.203, 156.246.94.183 (ports 80, 443, 53, 123)
- Threads: All 8 CPU cores, 30+ threads across RandomX and CryptoNight algorithms
- Config location:
/dev/shm/LZj
- Environment:
HTTPS_PROXY=http://127.0.0.1:41015 with NODE_EXTRA_CA_CERTS bypass
Timeline
- 2026-05-08 14:30 UTC:
.ldx binary creation timestamp on disk
- 2026-05-08 ~17:00 UTC: Discovered during routine system monitoring — two processes at 717% and 33% CPU running from
/dev/shm/ with random 7-character names (mEq6PcE, ByVbEI)
- 2026-05-08 18:30 UTC: Full cleanup completed — project directory removed, services disabled
Unknowns
- Infection vector was not determined. We could not establish whether
.ldx arrived via a compromised npm dependency, a direct attack on the server, or another mechanism. The project was cloned via git clone https://github.com/p-e-w/waidrin.git and dependencies installed via npm install.
- The Waidrin application features a Socket Firewall component (
manji.x86) that actively kills unauthorized processes on its network interfaces — this may be relevant to the attack surface.
Recommendation
Please audit recent npm dependency changes for any suspicious packages or postinstall scripts. Consider adding a SECURITY.md policy and enabling private vulnerability reporting on the repository.
Full Forensic Reference
A detailed incident response document is available with the full forensic analysis including xmrig config contents, process tree, persistence checks, and diagnostic commands used.
Summary
A cryptominer dropper binary (
.ldx, 3MB statically-linked ELF) and a secondary payload (let, 1.3MB UPX-packed ELF) were discovered in a cloned Waidrin project directory at/tmp/waidrin-build/. The dropper spawned xmrig Monero miners running from/dev/shm/(tmpfs) consuming 717% CPU.We have since removed the entire project from our system, but I am reporting this so you can investigate whether it originated from a compromised dependency or other supply chain vector.
Indicators
Dropper:
.ldx7cde0ffc28a6a25867655b2616cfc6cb01b08e9ba5ba043b26446b5eb8e248a07957727edae3fe27250377f345994aa2ba7f5143/dev/shm/and User-Agent stringsSecondary payload:
letCryptominer (xmrig)
imeatingpoop(Monero)45.196.97.119,91.208.184.203,156.246.94.183(ports 80, 443, 53, 123)/dev/shm/LZjHTTPS_PROXY=http://127.0.0.1:41015withNODE_EXTRA_CA_CERTSbypassTimeline
.ldxbinary creation timestamp on disk/dev/shm/with random 7-character names (mEq6PcE,ByVbEI)Unknowns
.ldxarrived via a compromised npm dependency, a direct attack on the server, or another mechanism. The project was cloned viagit clone https://github.com/p-e-w/waidrin.gitand dependencies installed vianpm install.manji.x86) that actively kills unauthorized processes on its network interfaces — this may be relevant to the attack surface.Recommendation
Please audit recent npm dependency changes for any suspicious packages or postinstall scripts. Consider adding a SECURITY.md policy and enabling private vulnerability reporting on the repository.
Full Forensic Reference
A detailed incident response document is available with the full forensic analysis including xmrig config contents, process tree, persistence checks, and diagnostic commands used.