The permcserver npm package (versions 1.0.0, 1.0.1, and 1.0.3) includes a 10-line JavaScript shim that loads a native shared object (lib-linux.so) implementing a VLESS-over-WebSocket proxy server. This proxy uses a hardcoded UUID for client authentication and supports SOCKS5/HTTP upstream proxies, enabling an attacker with the UUID to establish persistent, authenticated TCP tunnels through the host. The package exports no API and immediately activates the proxy upon import. It also attempts to conceal its malicious behavior by enumerating environment variables related to hosting panels and serving decoy HTML content consistent with Minecraft server management, misleading users about its purpose. The native code symbols indicate relay and TCP dialing functionality, confirming its role as a backdoor.

Importing or requiring the permcserver package on a host machine results in the immediate activation of a backdoor proxy server that allows an attacker who knows the hardcoded UUID to tunnel arbitrary TCP traffic through the compromised host. This grants persistent, authenticated access and the ability to execute arbitrary native code within the Node.js process, potentially leading to full system compromise or lateral movement within a network.

No official patch or remediation is currently available for this malicious package. Users should avoid installing or importing permcserver versions 1.0.0, 1.0.1, and 1.0.3. Remove any existing installations of this package immediately. Monitor for any unauthorized network proxy activity and consider scanning for the presence of this package or its native components. Since this is a malicious package, do not trust any decoy content it serves. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.