The node-fsmetrics-data npm package versions 1.0.0 and 1.0.1 include a malicious script (archive-sender.js) that archives sensitive data from the /root/.codex directory, splits it into 200MB chunks, and uploads these chunks by publishing to a related npm package (node-procmetrics-data) using an XOR-obfuscated npm registry authentication token. This token is stored in ~/.npmrc at runtime and can be extracted to push arbitrary versions to the npm account. The malicious code is not triggered by default during npm install, as index.js is empty and no lifecycle scripts or requires invoke archive-sender.js automatically. However, requiring or running archive-sender.js triggers the payload immediately.

Sensitive data from the /root/.codex directory on affected systems can be exfiltrated by the malicious script. The obfuscated npm authentication token embedded in the package allows attackers to publish arbitrary versions to the npm account, potentially enabling further supply chain attacks or distribution of additional malicious packages. Although the payload does not execute automatically on installation, manual execution or requiring the malicious file triggers data exfiltration and unauthorized npm publishing.

No official patch or remediation is currently documented. Users should avoid installing or using node-fsmetrics-data versions 1.0.0 and 1.0.1. Since the malicious payload does not execute on default npm install, simply installing the package without running the malicious file may prevent immediate compromise. However, to mitigate risk, remove these versions from projects and replace them with trusted alternatives. Monitor npm accounts for unauthorized publishing activity if these versions were used. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.