nano-perf@2.2.0

Analysis

Disguised as a Node.js performance profiler, this package is a command-and-control bot implant. Its postinstall script (node postinstall.js) launches a detached, unref'd background daemon (daemon.js) that keeps running after installation finishes, and also fires an immediate beacon inline. The daemon assigns each infected host a persistent id (cached under the system temp dir as .np-cache) and beacons every ~5 minutes (with jitter) to a hardcoded, base64-obfuscated backend endpoint, authenticating with an embedded service-role API token. Each beacon exfiltrates a host fingerprint (CPU core count, total/used memory, OS platform, timestamp). After a successful beacon it polls a remote task table for pending commands targeted at that host id, executes the returned task, and reports the result back — giving the operator a live, persistent task-execution channel into every machine that installed the package. Table names and request paths are deliberately labelled stealth_heartbeats / stealth_tasks, and the endpoint host and token are obfuscated by splitting and base64-encoding them across arrays.