@nimbusedge2/xa@1.1.0

Analysis

The preinstall hook of @nimbusedge2/xa@1.1.0 opens a reverse shell to 147[.]93[.]157[.]202[.]nip[.]io on port 8080 and pipes the interactive session to an exfiltration endpoint at hxxp://canarytokens[.]com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact[.]php. Installing the package gives the remote host an interactive bash shell on the victim machine and forwards the session's output to the canarytokens URL. The package ships no other code (package.json only).