The node-fsmetrics-native npm package version 1.0.0 contains malicious code that establishes a backdoor to a remote command and control (C2) server. Upon requiring the package, it decodes a URL and continuously polls the server for commands, executing them via bash and sending back the results. Additionally, a native addon component launches a separate thread that redundantly fetches and executes commands from the same server using curl and python3. The C2 server address is obfuscated in both JavaScript and native code to evade detection.