vps-new-manager@0.1.4

Analysis

The package vps-new-manager@0.1.4 contains a reverse shell backdoor in dist/server/index.js. When the module is imported (require'd or import'd), it unconditionally spawns a detached background shell process that connects back to 185[.]112[.]147[.]174:7007 via bash's /dev/tcp feature, giving the attacker an interactive shell on the victim's machine. The process is detached and unref'd so it survives the parent process and runs silently. The package is described as a Paperclip VPS maintenance adapter but the reverse shell code is not part of any exported function — it executes immediately on module load.