MAL-2026-10445

node-procmetrics is a malicious npm package. It is a throwaway, zero-download, no-repository package using a "process-metrics" decoy name, published by the disposable account foqumayum17@gmail.com (package first published 2026-07-13). Every published version (1.0.0 through 1.0.6) ships a malicious install script (install.js, executed automatically at npm install time) that:

1. Reads the entire process environment via a bulk ...process.env spread (whole-environment scoop);
2. Exfiltrates it to a hardcoded bare public-IP command-and-control endpoint, http://152.53.120.90/cmd/commands;
3. Imports child_process, http/https, and fs, colocating process-spawn (dropper) and filesystem-write (persistence) capability with the network send in the same install-time file.

Static analysis flags the full install-time credential-exfiltration combination inside install.js: credential/secret access + network send; whole-environment scoop + network send; network + process spawn (classic download-and-execute dropper); network + filesystem write (classic persistence). A hex-encoded/obfuscated payload string is also present in install.js.

Campaign: the same command-and-control IP 152.53.120.90 (endpoint path family /cmd) also appears in the install script of the sibling malicious package node-sysmetrics, published two days earlier by a different throwaway account (derepkoe@gmail.com). The shared C2 infrastructure, the shared "node-*metrics" decoy naming, and the identical install-time payload pattern under rotating disposable npm publisher accounts indicate a single actor running a coordinated campaign.

Indicators of compromise:

• Command-and-control: http://152.53.120.90/cmd/commands (bare public IP, RIPE/European hosting)
• Malicious versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 (all published versions)
• Publisher account: foqumayum17@gmail.com
• Related package sharing the same C2: node-sysmetrics (publisher derepkoe@gmail.com)

_-= Per source...