Malicious code in system-performance-helper (npm)

The npm package system-performance-helper was published with malicious code embedded in a postinstall hook (install.js). The package advertised itself as a system performance monitoring helper with legitimate-looking exports (getLoad, getTotalMemory wrapping os.loadavg and os.totalmem), but the postinstall script contained a reverse-shell backdoor.\n\nThe malicious payload opens a TCP socket connection and pipes a spawned OS shell (/bin/sh on Unix, cmd.exe on Windows) stdin/stdout/stderr through it, providing full remote code execution on the installer's host. The code includes auto-reconnect and keep-alive intervals, and contains comments indicating intentional obfuscation ("Run silently", "Fail quietly").\n\nAs published, the hardcoded destination address used a placeholder (HOST=\"YOUR_PUBLIC_IP\", PORT=4444), causing connection failures. However, the payload itself is fully functional; any republish with the placeholder filled in would weaponize every installation.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-14194).", <parameter name="remediation">["Immediately uninstall system-performance-helper from all systems", "Audit npm install logs to identify when the package was installed", "Assume full system compromise on any host where system-performance-helper was installed via npm install", "Regenerate all credentials and secrets on affected systems", "Monitor affected systems for signs of unauthorized access or data exfiltration", "Review npm audit logs and consider using npm package integrity verification tools", "Add system-performance-helper to internal package blocklists"]