registry / dateuuidv2 / 1.0.1

dateuuidv2@1.0.1

Generates a UUID based on the current date and time.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Importing the package triggers an undisclosed remote payload chain. It reads a project README, derives a concealed endpoint, fingerprints the host, drops a temporary VBS payload, and executes it.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing or requiring dateuuidv2.

Impact

Remote code execution in the importing user's environment.

Mechanism

concealed endpoint derivation, remote payload download, drop-and-execute

Attack narrative

Both public entrypoints load bootstrap code at import time. Bootstrap invokes extractDateISO, which reads the current project's README, uses a PORT value to construct decryption material for a hidden URL, POSTs platform/release data, writes the response to a temporary .vbs file, and executes it. Errors are intentionally swallowed, making the behavior silent.

Rationale

This is a concrete, undisclosed import-time remote code execution chain unrelated to a UUID package. The absence of lifecycle hooks does not mitigate the automatic runtime trigger.

Evidence

index.jsindex.mjslib/bootstrap.jslib/store.jsREADME.mdpackage.json${os.tmpdir()}/temp_<timestamp>.vbs

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js and index.mjs import lib/bootstrap on every package import.
lib/bootstrap.js immediately calls extractDateISO() and suppresses errors.
lib/store.js derives and decrypts a concealed URL from the consuming project's README PORT line.
lib/store.js POSTs OS/platform data to that URL, writes its response as a temporary .vbs file, then executes it with child_process.exec.
The README documents only UUID functions and does not disclose this import-time behavior.

Evidence against

package.json has no npm lifecycle scripts.
UUID generation and parsing functions are otherwise conventional.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 7.79 KB of source

Source & flagged code

3 flagged

lib/store.jsView file

60L61: const { exec } = require('child_process'); L62: const fs = require('fs/promises'); ... L117: async function readApiFromReadme( L118: projectRoot = process.cwd(), L119: ) { ... L147: const { algorithm, iv, encrypted, authTag } = sealedPackage; L148: const realKey = Buffer.from(secKey, 'hex'); L149: ... L192: async function fetchString(url) { L193: const response = await fetch(url, { L194: method: "POST",

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

lib/store.jsView on unpkg · L60

•Trigger-reachable chain: manifest.exports -> lib/store.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/store.jsView on unpkg

60L61: const { exec } = require('child_process'); L62: const fs = require('fs/promises');

High

Child Process

Package source references child process execution.

lib/store.jsView on unpkg · L60

Source & flagged code

3 flagged · loading source

lib/store.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

lib/store.jsView on unpkg · L60

•Trigger-reachable chain: manifest.exports -> lib/store.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/store.jsView on unpkg

60L61: const { exec } = require('child_process'); L62: const fs = require('fs/promises');

High

Child Process

Package source references child process execution.

lib/store.jsView on unpkg · L60

Findings

2 Critical1 High2 Medium2 Low

CriticalRemote Asset Decode Executelib/store.js

CriticalTrigger Reachable Dangerous Capabilitylib/store.js

HighChild Processlib/store.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings