MAL-2026-10464 Malicious code in node-procmetrics-data (npm)
Malicious package
Published
MAL-2026-10464 is a malicious package: node-procmetrics-data (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-10464/ (Markdown: https://insights.sbomify.com/MAL-2026-10464/index.md)
- Package
- node-procmetrics-data
- Registry
- npm
What is MAL-2026-10464?
MAL-2026-10464 is a malicious package in node-procmetrics-data, published on 13 Jul 2026.
Official description
[email protected] ships archive-sender.js which, at install/execution, tars the installer's root filesystem (excluding /proc, /sys, /dev, /tmp, /run) into /tmp/.archive_*.tar.gz, splits the archive into 200MB chunks, and publishes each chunk as a new version of
node-procmetrics-data to the public npm registry. Authentication uses a hardcoded npm _authToken shipped in the package as a hex literal XORed with 0x5A at runtime, and the code writes this token into the installer's npm config via npm config set //registry.npmjs.org/:_authToken. The registry is abused as a covert exfiltration channel, and the shipped token is obfuscated to evade static credential scanners. The publish loop also programmatically writes package.json/data.bin and runs npm publish --access public, extending the attacker's registry footprint from the installer's machine.What should I do about MAL-2026-10464?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.