MalwarePublished 13 Jul 2026Updated 15 Jul 2026

node-fsmetrics-data (npm) · Malicious Code

Affects node-fsmetrics-dataSource GCVE Database

Malicious package : remove node-fsmetrics-data and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:36 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10479

What to do

Remove node-fsmetrics-data from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnode-fsmetrics-data	Affected =1.0.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b67fad1d72f63941a3973df07e6cbd980c9e3c3bbe5041818f58b9be07d6b7e9) The tarball contains archive-sender.js, which tars the directory /root/.codex, splits the archive into 200MB chunks, and uploads each chunk by running `npm publish` against a sibling package name (node-procmetrics-data), using an npm registry `_authToken` that is XOR-obfuscated (hex bytes XOR 0x5A) and written into ~/.npmrc at runtime. The current package's hostname is embedded in the published manifest description. archive-sender.js calls archiveAndSend() at the top level, so `require`/`node` on that file triggers the archive-and-publish flow immediately. In this version index.js is empty, package.json declares no lifecycle scripts, and no other file requires archive-sender.js, so a default `npm install` does not auto-execute the payload — but the payload is fully wired and ships as a ready-to-run file inside the tarball. The obfuscated bundled publish token additionally allows anyone who extracts it to push arbitrary versions to the npm account it belongs to. ## Source: ghsa-malware (57ec12383e715341e57772316d09188e66f17f066466460b40ddff38405cb90f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Sensitive data from the /root/.codex directory on affected systems can be exfiltrated by the malicious script. The obfuscated npm authentication token embedded in the package allows attackers to publish arbitrary versions to the npm account, potentially enabling further supply chain attacks or distribution of additional malicious packages. Although the payload does not execute automatically on installation, manual execution or requiring the malicious file triggers data exfiltration and unauthorized npm publishing.

Defensive guidance

Users should avoid installing or using node-fsmetrics-data versions 1.0.0 and 1.0.1. Since the malicious payload does not execute on default npm install, simply installing the package without running the malicious file may prevent immediate compromise. However, to mitigate risk, remove these versions from projects and replace them with trusted alternatives. Monitor npm accounts for unauthorized publishing activity if these versions were used.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:53 UTC

Technical details

References

Community reviews