{"id":"MAL-2026-10464","summary":"Malicious code in node-procmetrics-data (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5ea7e26b73fb4fa21cdd545045f2a360a02d1013efe25cd6ab7aedb1fec72c9b)\nnode-procmetrics-data@1.0.1 ships archive-sender.js which, at install/execution, tars the installer's root filesystem (excluding /proc, /sys, /dev, /tmp, /run) into /tmp/.archive_*.tar.gz, splits the archive into 200MB chunks, and publishes each chunk as a new version of `node-procmetrics-data` to the public npm registry. Authentication uses a hardcoded npm `_authToken` shipped in the package as a hex literal XORed with 0x5A at runtime, and the code writes this token into the installer's npm config via `npm config set //registry.npmjs.org/:_authToken`. The registry is abused as a covert exfiltration channel, and the shipped token is obfuscated to evade static credential scanners. The publish loop also programmatically writes package.json/data.bin and runs `npm publish --access public`, extending the attacker's registry footprint from the installer's machine.\n","modified":"2026-07-13T18:16:55.513646851Z","published":"2026-07-13T17:37:03Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-13T17:37:03Z","sha256":"5ea7e26b73fb4fa21cdd545045f2a360a02d1013efe25cd6ab7aedb1fec72c9b","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-010267","import_time":"2026-07-13T18:10:12.159754462Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/node-procmetrics-data/v/1.0.1"}],"affected":[{"package":{"name":"node-procmetrics-data","ecosystem":"npm","purl":"pkg:npm/node-procmetrics-data"},"versions":["1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/node-procmetrics-data/MAL-2026-10464.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"archive-sender.js","sha256":"191b25adb3d130352a8a421721dae62e0afdc87541ed84724451bc9c0ac85435","tlsh":"0c51b5c71e6d2375ae6798c5a3a3e10613b7d1a33016f5e0b2ed87422f4362883764b9"}],"package_integrity":[{"hashes":{"sha1":"abc62b955298cac3c1d73f72b73d6ba225783cfa","sha512_sri":"sha512-E0K4r1qtekzeXX9k7IGKovPXxFv+qV5cBE4soABtAs0gwwDicHzq26i5ww2S9wfvSTOdsRd7U83Z2u0V9s2roQ=="},"filename":"node-procmetrics-data-1.0.1.tgz"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}