Malicious code in nano-perf (npm)
Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced process with ignored standard streams, allowing it to survive completion of npm install. The launcher reconstructs an obfuscated Supabase endpoint from Base64 fragments and sends a persistent node identifier, CPU count, total memory, platform information, and an online heartbeat to a table named stealth_heartbeats.
After a successful heartbeat the detached daemon polls a second table named stealth_tasks for pending work assigned to the victim node. The observed task handlers perform CPU benchmarking and system probing and upload the results. Although this version does not expose an arbitrary shell task, the hidden endpoint, automatic installation-time persistence, periodic beaconing, system fingerprint collection, and remote task polling are behavior of a covert C2 beacon and task agent rather than a performance utility.
Source: amazon-inspector
On npm install, package.json's postinstall hook (node postinstall.js) spawns daemon.js as a detached, unref'd background process (cp.spawn(process.execPath,[daemonPath],{detached:true,stdio:'ignore'}); child.unref();) that survives the install and beacons indefinitely. daemon.js generates a persistent node identifier in /tmp/.np-cache, then on a ~5 minute interval POSTs host fingerprint data (cpuCount, totalmem, platform, nodeId) to a Supabase REST endpoint and polls a sibling table for pending tasks keyed by node_id, executing returned commands via executeAndReport and PATCHing results back. The destination hostname (ojhkxcjvyfvtdsigwbxi.supabase.co/rest/v1/stealth_heartbeats /.../stealth_tasks) and the Supabase service_role JWT are obfuscated as base64 chunk arrays concatenated at runtime (daemon.js:24). The attacker-controlled tables are literally named stealth_heartbeats and stealth_tasks. Every machine that runs npm install nano-perf becomes a managed bot executing attacker-supplied commands.
