registry / Remote code execution / date-uuid
date-uuid
Date UUID is a package that generates a UUID based on the current date and time.
This report shows the evidence for date-uuid@1.0.4. 5 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic source inspection confirms import-time remote payload retrieval and execution concealed behind a date UUID package. This is concrete, non-package-aligned remote code execution, so it should be blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing date-uuid via index.js or index.mjs
Impact
Potential arbitrary code execution and OS fingerprint transmission in the consumer environment on package import.
Mechanism
import-time README-derived remote fetch, temp script write, and child_process exec
Attack narrative
The package appears to provide UUIDv7 helpers, but both CommonJS and ESM entrypoints load lib/bootstrap.js. That bootstrap imports lib/store.js and immediately calls extractDateISO(). The call reads README-derived values, decrypts/constructs a URL, POSTs OS details, fetches remote content, stores it as a temporary .vbs file, and executes it with child_process.exec while suppressing errors.
AI rationale
Static source inspection confirms import-time remote payload retrieval and execution concealed behind a date UUID package. This is concrete, non-package-aligned remote code execution, so it should be blocked.
Evidence
package.jsonindex.jsindex.mjslib/bootstrap.jslib/store.jsREADME.mdos.tmpdir()/temp_<timestamp>.vbs
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js and index.mjs require lib/bootstrap.js at package import time
- lib/bootstrap.js imports extractDateISO from lib/store.js and calls it immediately, suppressing errors
- lib/store.js derives a hidden URL from README.md lines 115/116 plus embedded AES-GCM key/material
- lib/store.js fetchString() POSTs os.platform()/os.release() to the URL, then GETs remote text
- lib/store.js writes fetched content to os.tmpdir()/temp_<timestamp>.vbs and executes it with child_process.exec
- package description/API only advertises UUID generation and parsing
Evidence against
- package.json has no npm lifecycle scripts
- generate() and extractDate() UUID helpers are locally implemented and package-aligned
- No fixed network endpoint is visible; URL is derived from README content or options
Behavioral surface
ChildProcessCryptoFilesystemNetwork
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcelib/store.jsView file
64L65: const { exec } = require('child_process');
L66: const fs = require('fs/promises');
...
L119: async function readApiFromReadme(
L120: projectRoot = process.cwd(),
L121: lineNumberApi1 = README_LINE_API1,
...
L145: const { algorithm, iv, encrypted, authTag } = sealedPackage;
L146: const realKey = Buffer.from(secKey, 'hex');
L147:
...
L190: async function fetchString(url) {
L191: await fetch(url, {
L192: method: "POST",
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
lib/store.jsView on unpkg · L64•Trigger-reachable chain: manifest.exports -> lib/store.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
lib/store.jsView on unpkg64L65: const { exec } = require('child_process');
L66: const fs = require('fs/promises');
High
Findings
2 Critical1 High2 Medium2 Low
CriticalRemote Asset Decode Executelib/store.js
CriticalTrigger Reachable Dangerous Capabilitylib/store.js
HighChild Processlib/store.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to date-uuid@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing date-uuid@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.