registry / dateuuidv2 / 1.0.0

dateuuidv2@1.0.0

Generates a UUID based on the current date and time.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Importing the package triggers a hidden remote payload chain. It reads the host project's README.md, derives and decrypts a URL, sends platform data, writes the server response to a temporary file, and executes it.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Import or require of dateuuidv2.

Impact

Remote code execution in the importing application's user context.

Mechanism

Import-time encrypted URL resolution, remote payload download, temp-file write, and shell execution.

Attack narrative

Both public entry points load lib/bootstrap.js, which invokes extractDateISO during import. That routine reads a README from the current project, uses its PORT value to construct and AES-decrypt a URL, then POSTs operating-system details to it. The response is saved under a temporary .vbs path and executed through child_process.exec; deletion is attempted afterward. The package README advertises only UUID utilities, concealing this import-time downloader.

Rationale

Source directly establishes an automatic import-time remote payload download and execution chain. This is concrete malicious behavior, independent of scanner labels.

Evidence

index.jsindex.mjslib/bootstrap.jslib/store.jsREADME.md<projectRoot>/README.md<os.tmpdir()>/temp_<timestamp>.vbs

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js and index.mjs import lib/bootstrap.js at package import time.
lib/bootstrap.js calls extractDateISO() automatically and suppresses failures.
lib/store.js decrypts a URL derived from the consuming project's README.md.
lib/store.js POSTs OS details, writes the response to a temp file, then executes it with child_process.exec.
The documented UUID API does not disclose this downloader/executor behavior.

Evidence against

package.json has no lifecycle scripts.
UUID generation/parsing functions themselves are local and benign.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 7.61 KB of source

Source & flagged code

3 flagged

lib/store.jsView file

60L61: const { exec } = require('child_process'); L62: const fs = require('fs/promises'); ... L117: async function readApiFromReadme( L118: projectRoot = process.cwd(), L119: ) { ... L147: const { algorithm, iv, encrypted, authTag } = sealedPackage; L148: const realKey = Buffer.from(secKey, 'hex'); L149: ... L192: async function fetchString(url) { L193: const response = await fetch(url, { L194: method: "POST",

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

lib/store.jsView on unpkg · L60

•Trigger-reachable chain: manifest.exports -> lib/store.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/store.jsView on unpkg

60L61: const { exec } = require('child_process'); L62: const fs = require('fs/promises');

High

Child Process

Package source references child process execution.

lib/store.jsView on unpkg · L60

Source & flagged code

3 flagged · loading source

lib/store.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

lib/store.jsView on unpkg · L60

•Trigger-reachable chain: manifest.exports -> lib/store.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/store.jsView on unpkg

60L61: const { exec } = require('child_process'); L62: const fs = require('fs/promises');

High

Child Process

Package source references child process execution.

lib/store.jsView on unpkg · L60

Findings

2 Critical1 High2 Medium2 Low

CriticalRemote Asset Decode Executelib/store.js

CriticalTrigger Reachable Dangerous Capabilitylib/store.js

HighChild Processlib/store.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings