OpenSSF/OSV advisory MAL-2026-14031 confirms this npm version as malicious. The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall. postinstall.js opens a TCP connection to the hardcoded remote 8.135.48.40:4444 and wires /bin/bash stdio to that socket, giving the remote endpoint an interactive shell on the installer's machine. Three redundant methods are attempted (python3 pty.spawn, python3 subprocess,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in datefmt-core-utils (npm)
Details
The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall. postinstall.js opens a TCP connection to the hardcoded remote 8.135.48.40:4444 and wires /bin/bash stdio to that socket, giving the remote endpoint an interactive shell on the installer's machine. Three redundant methods are attempted (python3 pty.spawn, python3 subprocess, and Node net+child_process.spawn of '/bin/bash -i'). The index.js date-formatting code is a cover story unrelated to the postinstall payload.
Decision reason
OpenSSF Malicious Packages via OSV confirms datefmt-core-utils@1.0.0 as malicious (MAL-2026-14031): Malicious code in datefmt-core-utils (npm)