nano-perf

GHSA-4f46-w499-cvxr

Malicious code in nano-perf (npm)

Details

**Severity:** Critical

**Affected versions:** `= 2.2.0`

Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced process with ignored standard streams, allowing it to survive completion of npm install. The launcher reconstructs an obfuscated Supabase endpoint from Base64 fragments and sends a persistent node identifier, CPU count, total memory, platform information, and an online heartbeat to a table named stealth_heartbeats.

After a successful heartbeat the detached daemon polls a second table named stealth_tasks for pending work assigned to the victim node. The observed task handlers perform CPU benchmarking and system probing and upload the results. Although this version does not expose an arbitrary shell task, the hidden endpoint, automatic installation-time persistence, periodic beaconing, system fingerprint collection, and remote task polling are behavior of a covert C2 beacon and task agent rather than a performance utility.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/93c874ee0e8a44e3f4e0fcdeab2c87088f7365a8/osv/malicious/npm/nano-perf/MAL-2026-11204.json))

**References:**
- https://github.com/ossf/malicious-packages/issues/1373
- https://github.com/ossf/malicious-packages/blob/93c874ee0e8a44e3f4e0fcdeab2c87088f7365a8/osv/malicious/npm/nano-perf/MAL-2026-11204.json
- https://www.npmjs.com/package/nano-perf/v/2.2.0
- https://github.com/advisories/GHSA-4f46-w499-cvxr

Compromised versions (1)

= 2.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.