The node-sysmetrics package (versions 1.0.0 and 1.0.1) includes a postinstall script that launches a detached Node.js process at /tmp/.sysm-agent.js. This agent continuously polls the npm registry for commands encoded in base64 within the package's dist-tags, decodes and executes them via bash on the infected host. Command outputs are base64-encoded and exfiltrated by publishing ephemeral public npm packages with the encoded data in the description field, using a hardcoded npm authentication token embedded in the install.js script. The token is also injected into the installer's global npm configuration (~/.npmrc), effectively hijacking the victim's npm credentials. This mechanism enables remote command execution and data exfiltration, indicating a full compromise of the affected system.

Any system with node-sysmetrics versions 1.0.0 or 1.0.1 installed is fully compromised. The attacker gains persistent remote code execution capabilities and can exfiltrate sensitive data. The attack also hijacks npm credentials, potentially allowing further malicious activity within the victim's npm environment. All secrets and keys stored on the compromised system are at risk and must be rotated from a clean environment.

No official patch or fix is currently available for this malicious package. Immediate removal of node-sysmetrics versions 1.0.0 and 1.0.1 is strongly recommended. Because the system is considered fully compromised, all secrets and credentials stored on the affected machine should be rotated from a separate, trusted device. Monitor for any unauthorized npm packages published using the hijacked credentials. Verify and clean the system thoroughly to remove any residual malicious components.