Malicious code in system-performance-helper (npm)

The 'system-performance-helper' npm package (version 1.0.0) includes a postinstall hook that executes 'node install.js'. This script attempts to open a TCP socket to a hardcoded IP address and port (currently set to 'YOUR_PUBLIC_IP' and 4444), spawning a shell process (/bin/sh on Unix or cmd.exe on Windows). The shell's stdin, stdout, and stderr are piped through the socket with auto-reconnect and keep-alive features, effectively creating a reverse shell backdoor. Although the hardcoded IP is a placeholder that prevents actual callback by default, any republishing of the package with a real IP would enable full remote code execution on any system installing the package. The package's index.js exports functions related to system load and memory as a cover, but these are not connected to the malicious postinstall behavior.

If the placeholder IP is replaced with a real address, installing this package would result in a reverse shell connection to an attacker-controlled server, granting full remote code execution on the victim's machine. This compromises the confidentiality, integrity, and availability of the host system. Even without modification, the presence of such a backdoor in the package poses a significant supply chain risk if republished or used as a dependency.

No official patch or fix is currently available. Users should avoid installing or using 'system-performance-helper' version 1.0.0. Verify package authenticity and source before installation, and consider removing this package if already installed. Monitor for republished versions with the placeholder replaced by a real IP address. Since this is not a cloud service, remediation depends on user action to avoid or remove the malicious package.