The 'vps-new-manager' npm package version 0.1.4 includes malicious code in its main module that, upon being required or imported, spawns a detached, unreferenced shell process. This shell establishes a reverse TCP connection to the hardcoded IP 185.112.147.174 on port 7007 via /dev/tcp redirection. The connection is interactive, granting the remote operator persistent command execution capabilities on the host. The malicious code is wrapped in a try/catch block to suppress errors and fires unconditionally at import time, unrelated to the package's stated VPS management functionality. This effectively compromises any host that loads this package.

Hosts that have the 'vps-new-manager' package version 0.1.4 installed or running are fully compromised, as the malicious code grants remote attackers persistent interactive command execution. This can lead to complete system takeover, data exfiltration, and further malicious activity. All secrets and keys stored on the compromised system are at risk and must be rotated from a secure environment. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is available for this malicious package version. Immediate removal of the 'vps-new-manager' package version 0.1.4 is recommended. All secrets and credentials stored on the affected system should be rotated from a different, trusted machine. Due to the nature of the compromise, consider rebuilding or thoroughly cleaning the affected system to ensure complete eradication of malicious code. Monitor for any suspicious activity related to the hardcoded IP address and network connections.