node-procmetricsnpm
node-procmetrics is a confirmed malicious npm package (MAL-2026-10445) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1, 1.0.2…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in node-procmetrics (npm)
What this malware does
node-procmetrics is a malicious npm package. It is a throwaway, zero-download, no-repository package using a "process-metrics" decoy name, published by the disposable account [email protected] (package first published 2026-07-13). Every published version (1.0.0 through 1.0.6) ships a malicious install script (install.js, executed automatically at npm install time) that:
- Reads the entire process environment via a bulk
...process.envspread (whole-environment scoop); - Exfiltrates it to a hardcoded bare public-IP command-and-control endpoint,
http://152.53.120.90/cmd/commands; - Imports
child_process,http/https, andfs, colocating process-spawn (dropper) and filesystem-write (persistence) capability with the network send in the same install-time file.
Static analysis flags the full install-time credential-exfiltration combination inside install.js: credential/secret access + network send; whole-environment scoop + network send; network + process spawn (classic download-and-execute dropper); network + filesystem write (classic persistence). A hex-encoded/obfuscated payload string is also present in install.js.
Campaign: the same command-and-control IP 152.53.120.90 (endpoint path family /cmd) also appears in the install script of the sibling malicious package node-sysmetrics, published two days earlier by a different throwaway account ([email protected]). The shared C2 infrastructure, the shared "node-*metrics" decoy naming, and the identical install-time payload pattern under rotating disposable npm publisher accounts indicate a single actor running a coordinated campaign.
Indicators of compromise:
- Command-and-control: http://152.53.120.90/cmd/commands (bare public IP, RIPE/European hosting)
- Malicious versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 (all published versions)
- Publisher account: [email protected]
- Related package sharing the same C2: node-sysmetrics (publisher [email protected])
install.js executes automatically via the package.json postinstall hook. It XOR-decodes (key 0x5A) a hardcoded npm registry auth token and writes it into the installer's global npm config at //registry.npmjs.org/:_authToken, replacing the installer's own npm authentication with an attacker-controlled identity. It then polls registry.npmjs.org for this package's dist-tags, base64-decodes the 'cmd' field, and executes the resulting string via spawnSync('bash', ['-c', cmd],...) in an infinite loop, giving the publisher arbitrary shell execution on any machine that installs the package. The output and exit code of each executed command are base64-encoded, placed into a synthesized package.json description field under /tmp/pm-pkg, and pushed back to the public npm registry via 'npm publish --access public' using the hijacked token, using the registry itself as the exfiltration channel. For persistence, install.js copies itself to /tmp/.pm-agent.js and spawns a detached, unref'd Node process pointing at that file, so the polling loop survives past the npm install invocation. The combination of covert channel via dist-tags, XOR-obfuscated embedded credential, credential replacement in the installer's npm config, and detached persistent process is unambiguous backdoor behavior at install time.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for node-procmetrics (10 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging node-procmetrics across your stack and pipelines.
If you installed it — respond
node-procmetrics is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If node-procmetrics was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks node-procmetrics before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- Ruthvik Ravikumar · finder
Detect & block this
O3 blocks node-procmetrics-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.