discord-vibegrations-api-helpers @1.0.0

Summary

The package declares a postinstall lifecycle hook ( postinstall: node postinstall.js ) that opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes it to a spawned /bin/sh process (client.pipe(sh.stdin); sh.stdout.pipe(client)). On npm install , this hands full interactive shell control of the installer's host to the remote endpoint, providing arbitrary code execution and a persistent backdoor for the duration of the tunnel. The ngrok dynamic-DNS tunnel is an attacker-controlled destination unrelated to any legitimate build behavior.

Source: amazon-inspector (e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6)