grafeno-billing@1.0.0

Analysis

The preinstall hook runs a script that harvests the installer's environment variables whose names match AWS/TOKEN/KEY/SECRET/PASS/API (values truncated to 80 chars), along with the hostname and username, base64-encodes them, and exfiltrates them to hxxp://216[.]126[.]236[.]46/r[.]php via curl. On non-Windows systems it also opens a reverse shell to 216[.]126[.]236[.]46:4444. The hook swallows all errors to hide failures.