catwrestlingbird@1.0.0

Analysis

The postinstall hook (node install.js) is a command-and-control implant. It beacons to hxxp://192[.]168[.]4[.]216:3000, POSTing host metadata (hostname, username, platform, arch, OS release, network interfaces, directory tree, env vars) and network-recon output (active connections via ss/netstat, ARP cache, routing table) to /api/beacon. It then spawns a detached background process (heartbeat.js) that pings /api/heartbeat every 60 seconds and, when instructed, opens a WebSocket reverse shell at /ws/shell/<beacon-id>/open that spawns /bin/sh with piped stdin, giving the operator remote command execution. On a kill command it removes itself from package.json/package-lock.json and deletes its own directory.