entropyeasybots@2.0.2

Analysis

entropyeasybots@2.0.2 is a reverse shell trojan. On install, the postinstall hook runs install.js which registers a systemd service named 'CustomBot' via the node-linux package for persistence. The main index.js spawns a detached background copy of itself, then opens a TCP reverse shell to 85[.]137[.]253[.]124 on port 1111, piping /bin/sh to give the attacker remote shell access. The C2 IP is base64-encoded in the source. The package also checks the INVOCATION_ID environment variable to detect container/sandbox environments.