npmamzs@1.1.1

Analysis

npmamzs@1.1.1 is a supply-chain attack package with no description, README, or legitimate functionality. Its postinstall hook runs index.js, which fetches a remote shell script from an ngrok tunnel at hxxps://reunionistic-keagan-unfestively[.]ngrok-free[.]dev/rev.sh and executes it via bash in a detached child process. Its sole purpose is downloading and running a second-stage payload from attacker-controlled infrastructure.