A bulk-mail & credential-cracking toolkit shipped as an npm package
The npm package monotenant@1.0.53 markets itself as "the only light-speed mailing server on planet earth." Its actual purpose is email abuse at scale: it verifies lists of stolen AWS SES, SMTP and Exchange (EWS) credentials, discovers targets via Shodan, and mass-mails through the validated accounts behind rotating proxies and fake identities — reporting results to an operator-controlled Telegram bot. It is not a supply-chain attack on whoever installs it (no install-time theft, no postinstall); it is a weapon the operator runs against third parties. We classify it as Abuse tooling and reported it to npm for takedown.
The npm package monotenant (version 1.0.53, plus 1.0.42 / 1.0.43 / 1.0.50) presents itself as a mailing product — its README reads "The only light-speed mailing server existing on planet earth." In reality it is an obfuscated abuse toolkit: every one of its 288 JavaScript files is run through a commercial obfuscator, and beneath that packing sits a bulk-mail and credential-cracking engine.
De-obfuscated, the modules describe their own function: an AWS SES credential verifier/mailer (it takes lists of AWS keys, checks their SES send capability at concurrency, and sends through the working ones), Shodan-based target discovery, and an SMTP / Microsoft Exchange (EWS) mailer (via nodemailer, imapflow, node-ews). It rotates SOCKS/HTTP proxies, fabricates sender identities with @faker-js/faker, packs results into encrypted archives, and reports to an operator-configured Telegram bot.
Crucially, monotenant does not harvest the credentials of the developer who installs it: there is no os.homedir() read of ~/.aws, ~/.ssh, .npmrc or .env, and no postinstall hook — nothing runs on npm install. It executes only when the operator deliberately runs its CLI. That distinction is why this is an abuse-tooling advisory, not a malware one.
Malware advisories (and the OSV / ossf-malicious-packages database) cover packages that attack whoever installs them — a poisoned postinstall, a hidden credential stealer, a download-and-execute dropper. monotenant does none of that to its installer.
monotenant is a tool for abusing third parties. The AWS/SMTP/EWS credentials it works on are operator-supplied target lists, and the Telegram endpoint is the operator's own results channel — not the victim developer's machine. Publishing such tooling to a public registry violates npm's Acceptable-Use policy (which prohibits using the service to send spam and to distribute tooling that facilitates attacks on other systems), but it is a registry-abuse / takedown matter, not a supply-chain infection.
We flag the distinction explicitly so defenders triage correctly: installing monotenant does not compromise your workstation or CI — but the package should not be on the registry, and its presence is a signal worth blocking.
Classified independently by codelake Research · AI-assisted triage + deterministic structural analysis (whole-package de-obfuscation; verified the absence of any installer-credential-theft path). Reported to npm for acceptable-use takedown.
This is an abuse-tooling advisory, not a supply-chain-malware one: monotenant does not attack the developer who installs it. No working payload or reproduction is published — the capability is described. The original artifact is preserved in the codelake archive and available to verified security researchers on request.