registry / Remote code execution / dateuuidv2
dateuuidv2
Generates a UUID based on the current date and time.
This report shows the evidence for dateuuidv2@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete, undisclosed import-time remote code execution chain unrelated to a UUID package. The absence of lifecycle hooks does not mitigate the automatic runtime trigger.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing or requiring dateuuidv2.
Impact
Remote code execution in the importing user's environment.
Mechanism
concealed endpoint derivation, remote payload download, drop-and-execute
Attack narrative
Both public entrypoints load bootstrap code at import time. Bootstrap invokes extractDateISO, which reads the current project's README, uses a PORT value to construct decryption material for a hidden URL, POSTs platform/release data, writes the response to a temporary .vbs file, and executes it. Errors are intentionally swallowed, making the behavior silent.
AI rationale
This is a concrete, undisclosed import-time remote code execution chain unrelated to a UUID package. The absence of lifecycle hooks does not mitigate the automatic runtime trigger.
Evidence
index.jsindex.mjslib/bootstrap.jslib/store.jsREADME.mdpackage.json${os.tmpdir()}/temp_<timestamp>.vbs
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js and index.mjs import lib/bootstrap on every package import.
- lib/bootstrap.js immediately calls extractDateISO() and suppresses errors.
- lib/store.js derives and decrypts a concealed URL from the consuming project's README PORT line.
- lib/store.js POSTs OS/platform data to that URL, writes its response as a temporary .vbs file, then executes it with child_process.exec.
- The README documents only UUID functions and does not disclose this import-time behavior.
Evidence against
- package.json has no npm lifecycle scripts.
- UUID generation and parsing functions are otherwise conventional.
Behavioral surface
ChildProcessCryptoFilesystemNetwork
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcelib/store.jsView file
60L61: const { exec } = require('child_process');
L62: const fs = require('fs/promises');
...
L117: async function readApiFromReadme(
L118: projectRoot = process.cwd(),
L119: ) {
...
L147: const { algorithm, iv, encrypted, authTag } = sealedPackage;
L148: const realKey = Buffer.from(secKey, 'hex');
L149:
...
L192: async function fetchString(url) {
L193: const response = await fetch(url, {
L194: method: "POST",
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
lib/store.jsView on unpkg · L60•Trigger-reachable chain: manifest.exports -> lib/store.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
lib/store.jsView on unpkg60L61: const { exec } = require('child_process');
L62: const fs = require('fs/promises');
High
Findings
2 Critical1 High2 Medium2 Low
CriticalRemote Asset Decode Executelib/store.js
CriticalTrigger Reachable Dangerous Capabilitylib/store.js
HighChild Processlib/store.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to dateuuidv2@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing dateuuidv2@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.