node-procmetrics (npm) · Malicious Code
Affects node-procmetricsSource GCVE Database
Malicious package : remove node-procmetrics and rotate any secrets on hosts that installed it.
Data as of 29 Jul 2026, 10:55 UTC
Malicious package
Published to npm · OSV MAL-2026-10445
What to do
Remove node-procmetrics from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmnode-procmetrics | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The node-procmetrics npm package is a malicious package that executes a harmful install script automatically during installation. The script exfiltrates the entire process environment to a hardcoded command-and-control server, hijacks the installer's npm authentication token to gain persistent arbitrary shell execution, and maintains persistence by spawning a detached Node.js process. This package is part of a coordinated campaign involving similarly named malicious packages using shared infrastructure. All published versions from 1.0.0 through 1.0.9 are affected.
References
- npmjs.com/package/node-procmetrics/v/1.0.7 (opens in a new tab)
- npmjs.com/package/node-procmetrics/v/1.0.1 (opens in a new tab)
- npmjs.com/package/node-procmetrics/v/1.0.5 (opens in a new tab)
- npmjs.com/package/node-procmetrics/v/1.0.9 (opens in a new tab)
- npmjs.com/package/node-procmetrics/v/1.0.4 (opens in a new tab)
- npmjs.com/package/node-procmetrics/v/1.0.8 (opens in a new tab)
- npmjs.com/package/node-procmetrics/v/1.0.6 (opens in a new tab)
- npmjs.com/package/node-procmetrics/v/1.0.3 (opens in a new tab)
- npmjs.com/package/node-procmetrics/v/1.0.2 (opens in a new tab)
- npmjs.com/package/node-procmetrics/v/1.0.0 (opens in a new tab)
- npmjs.com/package/node-procmetrics (opens in a new tab)