MalwarePublished 13 Jul 2026

node-sysmetrics (npm) · Malicious Code

Affects node-sysmetricsSource GCVE Database

Malicious package : remove node-sysmetrics and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10216

What to do

Remove node-sysmetrics from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnode-sysmetrics	Affected =1.0.0 =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The node-sysmetrics npm package versions 1.0.0 and 1.0.1 contain malicious code that executes a post-install script dropping a persistent background process. This process polls the npm registry for base64-encoded commands, executes them on the host, and exfiltrates results by publishing throwaway npm packages. It also hijacks the installer's npm credentials by embedding a hardcoded auth token in the global npm config. Systems with this package installed should be considered fully compromised, and all secrets should be rotated from a separate machine.

Impact

Any system with node-sysmetrics versions 1.0.0 or 1.0.1 installed is fully compromised. The attacker gains persistent remote code execution capabilities and can exfiltrate sensitive data. The attack also hijacks npm credentials, potentially allowing further malicious activity within the victim's npm environment. All secrets and keys stored on the compromised system are at risk and must be rotated from a clean environment.

Defensive guidance

Immediate removal of node-sysmetrics versions 1.0.0 and 1.0.1 is strongly recommended. Because the system is considered fully compromised, all secrets and credentials stored on the affected machine should be rotated from a separate, trusted device. Monitor for any unauthorized npm packages published using the hijacked credentials. Verify and clean the system thoroughly to remove any residual malicious components.

Summary

The node-sysmetrics package (versions 1.0.0 and 1.0.1) includes a postinstall script that launches a detached Node.js process at /tmp/.sysm-agent.js. This agent continuously polls the npm registry for commands encoded in base64 within the package's dist-tags, decodes and executes them via bash on the infected host. Command outputs are base64-encoded and exfiltrated by publishing ephemeral public npm packages with the encoded data in the description field, using a hardcoded npm authentication token embedded in the install.js script. The token is also injected into the installer's global npm configuration (~/.npmrc), effectively hijacking the victim's npm credentials. This mechanism enables remote command execution and data exfiltration, indicating a full compromise of the affected system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:52 UTC

Technical details

References

Community reviews