request-logger-canary@1.0.0

Analysis

Package request-logger-canary@1.0.0 ships a live reverse shell in its preinstall hook (preinstall.js). On npm install, the hook opens a TCP socket to 52[.]74[.]242[.]200:8851, spawns /bin/sh -i, and pipes stdin/stdout/stderr over the socket — giving the remote operator a full interactive shell on the installer's machine. The package description and README claim it is an inert security-research canary that only writes marker files to /tmp, but the actual preinstall.js code contains none of the claimed file-writing logic — it is only a bare reverse shell with no dead-code guard. The postinstall.js file declared in package.json is absent from the tarball. The "canary" framing is a social-engineering attempt to evade detection.