🛡️ MAL-2026-10465 — node-sysmon-native

Malicious code in node-sysmon-native (npm)

Source: amazon-inspector

On module load, index.js reconstructs a hex-encoded URL (Buffer.from('687474703a2f2f3135322e35332e3132302e39302f636d64','hex')) that decodes to http://152.53.120.90/cmd and enters an asynchronous polling loop that GETs /commands from that host, executes each returned command via spawnSync('bash', ['-c', cmd]) with a 55-second timeout and 5MB output buffer, and POSTs the stdout, stderr, and exit code back to /results. Any consumer that require()s this package grants the operator of 152.53.120.90 arbitrary shell execution on the host, with output exfiltration. The destination is a bare IP address reconstructed at runtime from a hex string to hide it from static scanners, and the package's declared 'sysmon-native' purpose provides no legitimate reason for polling a hardcoded remote host for shell commands.