MAL-2026-14194

Dashboard / Malicious Package / MAL-2026-14194

MAL-2026-14194

Summary: Malicious code in system-performance-helper (npm)

Details: Source: amazon-inspector (f382b23398f0b2550e29a61c444b8dbd45796d20c938dead6ada9d967d82cabc) Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook (`node install.js`) that opens a TCP socket and pipes a spawned OS shell (`/bin/sh` on Unix, `cmd.exe` on Windows) stdin/stdout/stderr through it, with auto-reconnect and a keep-alive interval — a canonical reverse-shell backdoor executed automatically on `npm install`. Bytes received from the remote peer are written directly into the shell, yielding full remote code execution on the installer's host. The destination is hardcoded as `HOST="YOUR_PUBLIC_IP"`, `PORT=4444`, so as-published the connect() fails DNS resolution and no callback occurs; the payload itself is fully functional and any republish with the placeholder filled in weaponizes every install. The visible exports in index.js (`getLoad`, `getTotalMemory` wrapping `os.loadavg`/`os.totalmem`) are a cover story; install.js contains `// Run silently` and `// Fail quietly` comments around the socket-to-shell pipe, and the advertised monitoring behavior is not present in the postinstall payload.

References: https://www.npmjs.com/package/system-performance-helper/v/1.0.0