react-copy-lite@1.0.1

Analysis

Trojanized npm package posing as a React clipboard hook. The exported useCopy API (dist/index.cjs) is benign decoy code. The postinstall hook (scripts/detach-run.cjs) spawns a detached background Node.js process running scripts/connect-loop.cjs. That script opens a TCP socket to 54[.]234[.]216[.]79:4444 and pipes it to /bin/bash (stdin/stdout/stderr), giving a remote attacker a full interactive shell on any machine that installs this package. It retries the connection every 10 seconds in an infinite loop, so the operator regains access if the victim machine restarts or the connection drops. Package has no legitimate purpose for this behaviour.