aikaf668897@1.0.3

Analysis

Package aikaf668897@1.0.3 is a string-utility library trojanized with a reverse shell. It exports legitimate string functions (capitalize, truncate, camelCase) from index.js as camouflage. However, its postinstall hook (scripts/postinstall.js) launches a detached child process running scripts/shell.js. shell.js opens a persistent TCP reverse shell to 114[.]67[.]90[.]67:3333 — on Unix it spawns /bin/sh -i; on Windows it spawns hidden powershell.exe. The shell's stdin/stdout/stderr are piped over the socket, giving the remote attacker interactive shell access. It auto-reconnects every 10 seconds on disconnect. Runtime testing confirmed outbound connections to 114[.]67[.]90[.]67:3333 with HTTP capture data exchanged.