Versions 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 2.1.0, and 2.2.0 of the npm package nano-perf include a postinstall script that launches a detached daemon process (daemon.js) which survives npm install completion. This daemon reconstructs an obfuscated Supabase endpoint and sends persistent node identifiers and system telemetry (CPU count, memory, platform info, heartbeat) to a remote table named stealth_heartbeats. It also polls a stealth_tasks table for commands, performing CPU benchmarking and system probing. The package silently exfiltrates host fingerprint and resource telemetry hourly via an AES-256-GCM encrypted POST to a hardcoded endpoint (https://ly-distilled-node.vercel.app/api/heartbeat). The encryption key is derived from the hostname, allowing the receiver to decrypt the data. The README does not disclose this behavior, which is enabled by default without opt-in. The package effectively acts as a covert command-and-control beacon and task agent rather than a legitimate performance utility.

Any system with nano-perf installed or running is considered fully compromised. The malicious daemon provides persistent remote access and telemetry exfiltration capabilities to the attacker. This includes system fingerprinting, resource usage monitoring, and remote task execution. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a separate, trusted system. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is available. The package should be immediately removed from all affected systems. All credentials, secrets, and keys stored on compromised systems must be rotated from a different, secure environment. Due to the persistent and covert nature of the malware, affected systems should be treated as fully compromised and undergo thorough incident response and remediation.