yoshino_s_test_evil@1.0.0

Analysis

The package's preinstall hook executes shell.js which establishes a TCP reverse shell to IP 152[.]136[.]32[.]206 on port 6677. It spawns /bin/sh and pipes the shell's stdin/stdout/stderr through the socket, giving the remote attacker interactive shell access on the installer's machine. The main entry point (index.js) is a decoy that prints "Hello, World!".