node-procmetrics-data

{"modified":"2026-07-13T17:37:03Z","published":"2026-07-13T17:37:03Z","schema_version":"1.7.4","id":"MAL-2026-10464","summary":"Malicious code in node-procmetrics-data (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5ea7e26b73fb4fa21cdd545045f2a360a02d1013efe25cd6ab7aedb1fec72c9b)\nnode-procmetrics-data@1.0.1 ships archive-sender.js which, at install/execution, tars the installer's root filesystem (excluding /proc, /sys, /dev, /tmp, /run) into /tmp/.archive_*.tar.gz, splits the archive into 200MB chunks, and publishes each chunk as a new version of `node-procmetrics-data` to the public npm registry. Authentication uses a hardcoded npm `_authToken` shipped in the package as a hex literal XORed with 0x5A at runtime, and the code writes this token into the installer's npm config via `npm config set //registry.npmjs.org/:_authToken`. The registry is abused as a covert exfiltration channel, and the shipped token is obfuscated to evade static credential scanners. The publish loop also programmatically writes package.json/data.bin and runs `npm publish --access public`, extending the attacker's registry footprint from the installer's machine.\n","affected":[{"package":{"ecosystem":"npm","name":"node-procmetrics-data"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"archive-sender.js","sha256":"191b25adb3d130352a8a421721dae62e0afdc87541ed84724451bc9c0ac85435","tlsh":"0c51b5c71e6d2375ae6798c5a3a3e10613b7d1a33016f5e0b2ed87422f4362883764b9"}],"package_integrity":[{"filename":"node-procmetrics-data-1.0.1.tgz","hashes":{"sha1":"abc62b955298cac3c1d73f72b73d6ba225783cfa","sha512_sri":"sha512-E0K4r1qtekzeXX9k7IGKovPXxFv+qV5cBE4soABtAs0gwwDicHzq26i5ww2S9wfvSTOdsRd7U83Z2u0V9s2roQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/node-procmetrics-data/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010267","import_time":"2026-07-13T18:10:12.159754462Z","modified_time":"2026-07-13T17:37:03Z","sha256":"5ea7e26b73fb4fa21cdd545045f2a360a02d1013efe25cd6ab7aedb1fec72c9b","source":"amazon-inspector","versions":["1.0.1"]}]}}