r4wk-book@2.2.2

Analysis

The postinstall hook executes a bundled script that spawns a detached background process, waits 1-40 seconds, then opens a TCP connection to 172[.]16[.]42[.]138:1234 and pipes an interactive shell (/bin/sh -i on Unix, cmd.exe on Windows) over the socket — a reverse shell giving the remote host command execution on the installer's machine. The C2 address is stored base64-encoded in the script.