nano-perf@2.1.0

Analysis

Despite advertising itself as a lightweight Node.js performance profiler, this package contains no profiler functionality. Its package.json registers a postinstall lifecycle hook (postinstall.js) that runs automatically on install. The script generates and persists a stable node identifier in ~/.np-id, then collects host reconnaissance - OS platform, CPU architecture, CPU core count, Node.js version, total system memory, and a timestamp - and transmits it as JSON to a hardcoded Supabase REST endpoint (ojhkxcjvyfvtdsigwbxi[.]supabase[.]co/rest/v1/stealth_heartbeats). The destination URL is assembled from a base64-split array and the authentication credential (a Supabase service_role JWT) is embedded split and reversed in the source, explicitly to evade string and regex searches per the code comments. The behaviour - persistent host ID, periodic-style heartbeat to a table named stealth_heartbeats, and host fingerprinting - is consistent with botnet enrollment / install-time recon.