grafeno-payments @1.0.0

Summary

On npm install , package.json's preinstall hook ( node preinstall.js || true ) auto-runs a script that (1) enumerates process.env for keys matching AWS|TOKEN|KEY|SECRET|PASS|API, concatenates them with the machine's hostname and username, base64-encodes the blob, and exfiltrates it via curl GET to http://216.126.236.46/r.php over plain HTTP; and (2) on non-Windows hosts invokes bash -i with a /dev/tcp redirection to 216.126.236.46:4444, giving the remote endpoint an interactive shell on the installer's machine. The || true suffix suppresses errors so npm install reports success while the payload runs. The package's stated payments purpose is a cover story; the shipped preinstall behavior is credential theft plus full-host remote code execution against the installer.

Source: amazon-inspector (7af58da84956e51749cbb96923f12264cfdee76456b5010b526599b7da2c0caa)