MAL-2026-10445 Malicious code in node-procmetrics (npm)

node-procmetrics is a malicious npm package. It is a throwaway, zero-download, no-repository package using a "process-metrics" decoy name, published by the disposable account [email protected] (package first published 2026-07-13). Every published version (1.0.0 through 1.0.6) ships a malicious install script (install.js, executed automatically at npm install time) that:

1. Reads the entire process environment via a bulk ...process.env spread (whole-environment scoop);
2. Exfiltrates it to a hardcoded bare public-IP command-and-control endpoint, http://152.53.120.90/cmd/commands;
3. Imports child_process, http/https, and fs, colocating process-spawn (dropper) and filesystem-write (persistence) capability with the network send in the same install-time file.

Static analysis flags the full install-time credential-exfiltration combination inside install.js: credential/secret access + network send; whole-environment scoop + network send; network + process spawn (classic download-and-execute dropper); network + filesystem write (classic persistence). A hex-encoded/obfuscated payload string is also present in install.js.

Campaign: the same command-and-control IP 152.53.120.90 (endpoint path family /cmd) also appears in the install script of the sibling malicious package node-sysmetrics, published two days earlier by a different throwaway account ([email protected]). The shared C2 infrastructure, the shared "node-*metrics" decoy naming, and the identical install-time payload pattern under rotating disposable npm publisher accounts indicate a single actor running a coordinated campaign.

Indicators of compromise:

• Command-and-control: http://152.53.120.90/cmd/commands (bare public IP, RIPE/European hosting)
• Malicious versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 (all published versions)
• Publisher account: [email protected]
• Related package sharing the same C2: node-sysmetrics (publisher [email protected])

install.js executes automatically via the package.json postinstall hook. It XOR-decodes (key 0x5A) a hardcoded npm registry auth token and writes it into the installer's global npm config at //registry.npmjs.org/:_authToken, replacing the installer's own npm authentication with an attacker-controlled identity. It then polls registry.npmjs.org for this package's dist-tags, base64-decodes the 'cmd' field, and executes the resulting string via spawnSync('bash', ['-c', cmd],…) in an infinite loop, giving the publisher arbitrary shell execution on any machine that installs the package. The output and exit code of each executed command are base64-encoded, placed into a synthesized package.json description field under /tmp/pm-pkg, and pushed back to the public npm registry via 'npm publish –access public' using the hijacked token, using the registry itself as the exfiltration channel. For persistence, install.js copies itself to /tmp/.pm-agent.js and spawns a detached, unref'd Node process pointing at that file, so the polling loop survives past the npm install invocation. The combination of covert channel via dist-tags, XOR-obfuscated embedded credential, credential replacement in the installer's npm config, and detached persistent process is unambiguous backdoor behavior at install time.