Fake “system metrics” npm package that opens a remote-command backdoor on npm install
The npm package node-procmetrics@1.0.3 presents itself as a “System metrics collector” — a decoy. It ships no repository, no homepage and no CLI, and its real payload is a postinstall hook that runs the moment you npm install. It launches an agent that connects to a hardcoded raw-IP C2 (152.53.120.90), polls it for commands, executes them via spawned processes, and POSTs the output back — giving the operator remote command execution on any machine or CI runner that installs it, with persistence and access to local secrets.
The npm package node-procmetrics (version 1.0.3) describes itself as a “System metrics collector.” That description is the disguise: it ships no source repository, no homepage and no bin, and a legitimate metrics library has no reason to do what this one does on install.
Its package.json declares a postinstall hook that runs install.js, so the payload executes automatically on npm install, before the package is ever imported — including in CI, containers and developer machines.
codelake surfaced it from the live npm feed via its install-hook behaviour pipeline; the hardcoded raw-IP C2, the /commands polling loop and the spawn-and-report control flow are the decisive signals. It is also recorded in OSV as MAL-2026-10445 — this advisory is an independent confirmation and a defensive-indicator record, not a first-catch claim.
1 · Calls home to a hardcoded C2. On install it connects to http://152.53.120.90 — a bare IP address with no domain, declared nowhere in the package metadata.
2 · Polls for commands. It repeatedly requests /commands from the C2 — the operator queues arbitrary commands there.
3 · Executes them. Received commands are run via spawned processes on the host — arbitrary remote command execution.
4 · Reports back. Command output is POSTed to /results on the same C2, closing the remote-control loop.
5 · Persistence & local secrets. The agent keeps itself alive (detached / looping) and touches local credential locations (~/.ssh, ~/.aws, ~/.npmrc, environment) — so a single npm install is enough to hand over the host.
Detected + classified independently by codelake Research via its install-hook behaviour pipeline · deterministic structural analysis of the packed tarball (package.json postinstall hook, raw-IP C2, /commands poll → spawn → /results report). Also recorded in OSV as MAL-2026-10445 — this is an independent confirmation and defensive-indicator record, not a first-catch claim.
This is a confirmed-malware advisory. No working payload or reproduction is published — the behaviour is described from structural analysis, and the C2 endpoint is named as a defensive indicator only. The original artifact is preserved in the codelake archive and available to verified security researchers on request.