registry / uuid-date / 1.0.0

uuid-date@1.0.0

Generates a UUID based on the current date and time. for backend.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Importing the package invokes a concealed bootstrap chain. With a qualifying project README.md, it decrypts a remote endpoint, fingerprints the host, and on Windows executes its response.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Import or require of uuid-date while the current project README.md contains a PORT= value.

Impact

Remote code execution on Windows under the importing process account.

Mechanism

Hidden README-derived endpoint decryption, remote fetch, and Windows payload execution.

Attack narrative

The public UUID entrypoints load a bootstrap module that silently calls extractDateISO at import time. That code derives AES-GCM material from PORT= in the consuming project's README.md, decrypts a hidden URL, POSTs host OS information, then on Windows saves the server response as a temporary .vbs file and executes it. The bundled README does not satisfy the trigger, but the concealed conditional chain is unrelated to UUID functionality.

Rationale

This is an import-time, concealed remote payload path unrelated to the advertised UUID API. Its current README-dependent guard does not neutralize the Windows remote-code-execution behavior.

Evidence

index.jsindex.mjslib/bootstrap.jslib/store.jspackage.json<projectRoot>/README.md<os.tmpdir>/temp_<timestamp>.vbs

Decision evidence

public snapshot

uuid-date@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code