yian666aikf@1.0.3

Analysis

Package yian666aikf@1.0.3 impersonates a lightweight string-manipulation utility but delivers a reverse shell on install. The postinstall hook (node scripts/postinstall.js) launches a detached, hidden Node.js process that executes scripts/shell.js. This script opens a TCP reverse shell to 114[.]67[.]90[.]67:4444, spawning powershell.exe on Windows or /bin/sh -i on Unix with all I/O piped over the socket. It auto-reconnects every 10 seconds if the connection drops. The hook uses detached subprocess with unref() and hidden window flags to avoid detection during npm install. The index.js file contains harmless string utility functions as a decoy.