system-performance-helper @1.0.0

Summary

Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook ( node install.js ) that opens a TCP socket and pipes a spawned OS shell ( /bin/sh on Unix, cmd.exe on Windows) stdin/stdout/stderr through it, with auto-reconnect and a keep-alive interval — a canonical reverse-shell backdoor executed automatically on npm install . Bytes received from the remote peer are written directly into the shell, yielding full remote code execution on the installer's host. The destination is hardcoded as HOST="YOUR_PUBLIC_IP" , PORT=4444 , so as-published the connect() fails DNS resolution and no callback occurs; the payload itself is fully functional and any republish with the placeholder filled in weaponizes every install. The visible exports in index.js ( getLoad , getTotalMemory wrapping os.loadavg / os.totalmem ) are a cover story; install.js contains // Run silently and // Fail quietly comments around the socket-to-shell pipe, and the advertised monitoring behavior is not present in the postinstall payload.

Source: amazon-inspector (f382b23398f0b2550e29a61c444b8dbd45796d20c938dead6ada9d967d82cabc)