aikaf6688812@1.0.3

Analysis

Package aikaf6688812 (advertised as a string utility library) executes a TCP reverse shell upon `npm install`. The postinstall hook spawns a detached Node.js process running scripts/shell.js, which opens a raw TCP socket to 114[.]67[.]90[.]67:3334, connects it to /bin/sh -i (or powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle hidden on Windows), and pipes stdin/stdout/stderr bidirectionally. The shell automatically reconnects every 10 seconds on disconnect or error. The installer's shell is fully exposed to the remote attacker while the package pretends to export harmless string functions (capitalize, truncate, camelCase, etc.).