node-sysmon-native@1.0.1

One or more suspicious static signals were detected.

Module import; additionally `getCpuInfo()` invokes the native agent path.

An attacker controlling the hard-coded server can execute arbitrary commands as the application user and receive their output.

Remote C2 polling followed by arbitrary `bash -c` execution and result exfiltration.

On import, `index.js` continuously polls a hard-coded C2 endpoint for commands, executes each through `bash -c`, and sends output back to the server. Its native addon independently contains an obfuscated copy of the endpoint and starts a detached curl/Python/bash agent when `getCpuInfo()` is called. The purported monitoring API provides cover for arbitrary remote code execution.

Direct source inspection confirms unconsented remote command-and-control behavior, arbitrary shell execution, and command-output exfiltration. The standard native-build install hook enables the malicious addon but is not required for the JS import-time C2 path.