Malicious npm Package Disguised as Advcash Integration Trigg...

A malicious npm package, @naderabdi/merchant-advcash, masquerading as a legitimate Advcash (Volet) payment integration, was discovered to contain a stealthy reverse shell. The payload activates only during a successful payment transaction.