The node-procmetrics npm package is a malicious package that executes a harmful install script automatically during installation. The script exfiltrates the entire process environment to a hardcoded command-and-control server, hijacks the installer's npm authentication token to gain persistent arbitrary shell execution, and maintains persistence by spawning a detached Node.js process. This package is part of a coordinated campaign involving similarly named malicious packages using shared infrastructure. All published versions from 1.0.0 through 1.0.9 are affected.