Malicious code in nano-perf (npm)

Version 2.2.0 of nano-perf, an npm package, was found to contain malicious code embedded in a postinstall script. Upon installation, the script launches a detached daemon process (daemon.js) that survives the completion of npm install by ignoring standard streams and running as a background process.

The malware reconstructs an obfuscated Supabase endpoint from Base64-encoded fragments and establishes persistent communication with a remote command-and-control server. It collects and transmits system information including a persistent node identifier, CPU count, total memory, platform details, and periodic online heartbeats to a table named stealth_heartbeats.

After successful heartbeat registration, the daemon polls a second remote table named stealth_tasks to retrieve and execute work assigned to the compromised node. Observed task handlers perform CPU benchmarking and system probing, with results uploaded back to the attacker infrastructure. Although arbitrary shell execution was not observed in this version, the combination of hidden endpoints, installation-time persistence, periodic beaconing, system fingerprinting, and remote task polling constitutes a fully functional covert C2 beacon and task agent.

The malicious package was identified and credited to the OpenSSF's malicious-packages project.