node-procmetrics is a malicious npm package published by a disposable account. Its install.js script runs automatically at npm install time and performs multiple malicious actions: it reads and exfiltrates the full process environment to a hardcoded public IP command-and-control endpoint; it XOR-decodes and writes a stolen npm registry authentication token into the installer's global npm config, effectively hijacking the installer's npm identity; it polls the npm registry for commands encoded in dist-tags and executes them in an infinite loop with arbitrary shell access; it exfiltrates command output back to the npm registry by republishing the package with encoded data; and it achieves persistence by copying itself to /tmp/.pm-agent.js and spawning a detached Node.js process. The same command-and-control IP is used by a sibling malicious package, indicating a coordinated campaign by a single actor. All published versions 1.0.0 through 1.0.9 are affected.

This malicious package compromises any system that installs it by exfiltrating sensitive environment variables, hijacking npm credentials to gain persistent arbitrary command execution, and maintaining a covert backdoor that communicates via the npm registry. This enables the attacker to execute arbitrary shell commands indefinitely, potentially leading to full system compromise and unauthorized access to private data and credentials.

No official patch or remediation is available as this is a malicious package rather than a vulnerability in legitimate software. The package should be removed from all environments and blocked from installation. Users and organizations should audit their dependencies to ensure node-procmetrics and related malicious packages (e.g., node-sysmetrics) are not present. Avoid installing packages from untrusted or disposable publisher accounts. Monitor for any npm config changes or unexpected persistent Node.js processes spawned from temporary directories. Since this is a malicious package, remediation involves removing it and preventing its installation rather than patching.