[email protected] includes a malicious script (archive-sender.js) that collects the installer's root filesystem data (excluding /proc, /sys, /dev, /tmp, /run), compresses it into a tar archive, splits it into 200MB chunks, and exfiltrates these chunks by publishing them as new versions of the package to the public npm registry. The package contains a hardcoded npm authentication token obfuscated via XOR with 0x5A, which is written into the npm config to enable publishing. This technique abuses the npm registry as a covert channel for data exfiltration and allows the attacker to expand their presence by publishing additional malicious package versions from the victim's environment.

Sensitive data from the installer's root filesystem can be exfiltrated without detection through the npm registry. The attacker gains the ability to publish new package versions from the compromised environment, potentially spreading malicious code further. This compromises confidentiality and integrity of the affected system and the npm ecosystem.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance. Users should immediately remove and avoid using node-procmetrics-data version 1.0.1. Audit npm packages for unauthorized publishing activity and revoke any exposed npm authentication tokens. Consider rotating npm credentials and monitoring for suspicious package publication.