registry / Remote code execution / uuid-date
uuid-date
Generates a UUID based on the current date and time. for backend.
This report shows the evidence for uuid-date@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is an import-time, concealed remote payload path unrelated to the advertised UUID API. Its current README-dependent guard does not neutralize the Windows remote-code-execution behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Import or require of uuid-date while the current project README.md contains a PORT= value.
Impact
Remote code execution on Windows under the importing process account.
Mechanism
Hidden README-derived endpoint decryption, remote fetch, and Windows payload execution.
Attack narrative
The public UUID entrypoints load a bootstrap module that silently calls extractDateISO at import time. That code derives AES-GCM material from PORT= in the consuming project's README.md, decrypts a hidden URL, POSTs host OS information, then on Windows saves the server response as a temporary .vbs file and executes it. The bundled README does not satisfy the trigger, but the concealed conditional chain is unrelated to UUID functionality.
AI rationale
This is an import-time, concealed remote payload path unrelated to the advertised UUID API. Its current README-dependent guard does not neutralize the Windows remote-code-execution behavior.
Evidence
index.jsindex.mjslib/bootstrap.jslib/store.jspackage.json<projectRoot>/README.md<os.tmpdir>/temp_<timestamp>.vbs
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js imports lib/bootstrap on package import.
- lib/bootstrap.js invokes extractDateISO automatically and suppresses failures.
- lib/store.js reads cwd README.md to derive an AES key and decrypt a hidden URL.
- lib/store.js POSTs OS platform/release to that URL.
- On Windows, fetched content is written to a temp .vbs path and executed with child_process.exec.
Evidence against
- package.json has no lifecycle scripts.
- Bundled README.md lacks the required PORT line, so the import-time chain currently errors before networking.
- The Linux/macOS branch executes literal "content", not the fetched payload.
Behavioral surface
ChildProcessCryptoFilesystemNetwork
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcelib/store.jsView file
60L61: const { exec } = require('child_process');
L62: const fs = require('fs/promises');
...
L117: async function readApiFromReadme(
L118: projectRoot = process.cwd(),
L119: ) {
...
L147: const { algorithm, iv, encrypted, authTag } = sealedPackage;
L148: const realKey = Buffer.from(secKey, 'hex');
L149:
...
L192: async function fetchString(url) {
L193: const response = await fetch(url, {
L194: method: "POST",
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
lib/store.jsView on unpkg · L60•Trigger-reachable chain: manifest.exports -> lib/store.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
lib/store.jsView on unpkg60L61: const { exec } = require('child_process');
L62: const fs = require('fs/promises');
High
Findings
2 Critical1 High2 Medium2 Low
CriticalRemote Asset Decode Executelib/store.js
CriticalTrigger Reachable Dangerous Capabilitylib/store.js
HighChild Processlib/store.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to uuid-date@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing uuid-date@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.