friendly-greeter-demonpm

The package presents itself as a trivial greeting library but ships two independent backdoor paths to a hardcoded bare-IP C2 at http://98.86.244.177:8080. (1) package.json declares "postinstall": "node postinstall.js", which fires on every npm install. postinstall.js re-spawns itself as a detached daemon (POSTINSTALL_DAEMON=1), POSTs the installer's os.hostname() and process.platform to /register, polls /beacon for a command field, executes it via child_process.exec with a 30s timeout, and POSTs stdout+stderr back to /results in a jittered loop — a persistent command-and-control backdoor that survives the install and grants the operator of 98.86.244.177 full shell on the installer's machine. (2) index.js (the declared main) contains a top-level IIFE that performs the same /register → /beacon → exec → /results flow on require('friendly-greeter-demo'), so any consumer that imports the package as a library also gets full RCE. The C2 destination is a bare IPv4 over plaintext HTTP, with no relation to the package's stated greeting purpose.