Malware in node-fsmetrics-native
Malware was discovered in the npm package node-fsmetrics-native, providing full system compromise to any computer with the package installed or running. All affected systems should be considered fully compromised and all secrets and keys rotated from a different computer.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- node-fsmetrics-native
A malicious package named node-fsmetrics-native was published to npm and contains malware that provides full system compromise to any computer that has it installed or running.\n\nAccording to the GitHub Advisory (GHSA-hfgq-7j44-m23h), any system with this package installed should be considered fully compromised. The advisory recommends immediate rotation of all secrets and keys from a different, unaffected computer.\n\nWhile the package should be removed, the advisory notes that because full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from the installation.\n\nThe package has been identified and removed from npm distribution.
Indicators of compromise
- Packages
- node-fsmetrics-native
Remediation
- Immediately identify all systems with node-fsmetrics-native installed or running
- Rotate all secrets, keys, and credentials from a different, unaffected computer
- Remove the node-fsmetrics-native package from all affected systems
- Perform a full security audit and malware scan on all affected systems
- Review system logs and network traffic for signs of unauthorized access or data exfiltration
- Consider full system reimaging if compromise is suspected
Sources
- GitHub Advisory GHSA-hfgq-7j44-m23h · GitHub Advisory Database
Cite this entry
"Malware in node-fsmetrics-native." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 14, 2026; last updated July 14, 2026. https://supplychainattack.org/incident/malware-in-node-fsmetrics-native-a17due
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - containedcritical
Malicious code in cewe-npm-cops (npm)
cewe-npm-cops@99.9.9 is a malicious npm package that exfiltrates the installer's machine hostname via DNS to an attacker-controlled out-of-band service. The package uses a high version number (99.9.9) to override internal packages during dependency resolution and executes a preinstall script that leaks system information.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in dpdgroup-css (npm)
The npm package dpdgroup-css contained malicious code that executed on installation, exfiltrating the installer's hostname to an external IP address. The package name mimics an internal DPDgroup scope, suggesting a dependency-confusion attack targeting the courier organization.
npmCompromised packageDependency confusion