entropyeasybots @2.0.2

Summary

index.js decodes a base64-obfuscated IP (85.137.253.124) and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111, granting remote shell access on the installer's host. package.json declares postinstall: sudo node install.js , and install.js uses node-linux's Service API to register a systemd unit named CustomBot that runs index.js with maxRestarts:10, providing root-level persistence of the backdoor across reboots. The C2 IP is stored as a base64 string and reconstructed at runtime to hide the destination.

Source: amazon-inspector (82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa)