ore-miner
Audited by Socket on Jun 19, 2026
3 alerts found:
SecurityMalwareAnomalyThis module is a purpose-built mining launcher that authenticates with a provided API key, fetches the associated wallet address, and starts automated mining on a remote service with custom tile IDs and auto-restart enabled. While it lacks obfuscation and does not perform typical malware behaviors like reverse shells or local data theft, its explicit cryptomining side effect and persistent configuration make it high-risk and likely malicious/abusive if executed without clear user authorization and a trusted API endpoint.
This module is a networked automation client that starts an auto-restarting mining session via a remote API using a user-provided API key. It does not show classic malware traits (no persistence, shell control, or host data theft) in the provided code. The primary risks are operational/abuse: it will continuously/recurringly request mining activity (auto_restart + every_round) and it will send the API key to an arbitrary, user-supplied API_URL without domain/protocol validation, while also logging wallet address and response bodies.