node-procmetrics@1.0.6

Analysis

The postinstall hook in install.js deploys a persistent remote access trojan. It copies itself to /tmp/.pm-agent.js, spawns a detached background process, and installs a crontab entry for persistence. The agent polls hxxp://152[.]53[.]120[.]90/cmd/commands every second for commands, executes them via bash -c, and exfiltrates the output to hxxp://152[.]53[.]120[.]90/cmd/results. The C2 server can push arbitrary shell commands to the infected machine.