prisma-callback@1.0.0

Analysis

A combosquat of the Prisma ORM. The preinstall hook (node ./scripts/only-allow-pnpm.js) masquerades as a standard package-manager guard but appends a raw TCP reverse shell: it opens a socket to 52[.]74[.]242[.]200:8851 and spawns /bin/sh -i with stdin/stdout/stderr piped through the socket, giving an attacker an interactive shell on any machine that installs the package.