{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3034",
  "modified": "2026-07-15T09:00:00Z",
  "published": "2026-07-15T09:00:00Z",
  "summary": "Fake “system metrics” npm package that opens a remote-command backdoor on npm install",
  "details": "The npm package node-procmetrics@1.0.3 presents itself as a “System metrics collector” — a decoy. It ships no repository, no homepage and no CLI, and its real payload is a postinstall hook that runs the moment you npm install. It launches an agent that connects to a hardcoded raw-IP C2 (152.53.120.90), polls it for commands, executes them via spawned processes, and POSTs the output back — giving the operator remote command execution on any machine or CI runner that installs it, with persistence and access to local secrets.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "node-procmetrics"
      },
      "versions": [
        "1.0.3"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3034-node-procmetrics"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/MAL-2026-10445"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3034",
    "kind": "malware",
    "class": "Install-time C2 / RAT (remote command execution)",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [
        "152.53.120.90"
      ],
      "hashes": [
        "sha256:4cfe9c14111f28d8c50785674199700504ce5947c7004e4182479a2fa129d1ee"
      ],
      "indicators": [
        "node-procmetrics@1.0.3 (npm) — “System metrics collector”, no repository / homepage / bin",
        "4cfe9c14111f28d8c50785674199700504ce5947c7004e4182479a2fa129d1ee (tarball)",
        "package.json: \"postinstall\" → node install.js — runs on install, before import",
        "http://152.53.120.90 — /commands (poll), /results (report)",
        "commands from C2 executed via spawned child processes",
        "detached / looping agent; touches ~/.ssh, ~/.aws, ~/.npmrc, env",
        "MAL-2026-10445"
      ]
    }
  }
}