aikaf788812@1.0.3

Analysis

During npm install, the postinstall hook runs scripts/postinstall.js which spawns scripts/shell.js as a hidden background process. shell.js establishes a reverse shell backdoor to C2 host 114[.]67[.]90[.]67 using four concurrent methods: (1) Node.js net module TCP connect-back on ports 3334, 4444, 443, 80, 8080, and 53; (2) bash /dev/tcp reverse shell on the same ports (Linux/macOS); (3) Python reverse shell (python3 then python fallback) with threading on the same ports; (4) A HTTP pingback to 114[.]67[.]90[.]67:8333 at /ping?h=HOSTNAME&u=USER&d=CWD&o=OS_INFO that exfiltrates the installer's hostname, username, working directory, and operating system details. The package disguises itself as a string manipulation utility (index.js exports capitalize/truncate/camelCase etc.) but the payload is in scripts/postinstall.js and scripts/shell.js.