date-fns-formatter@1.4.9

Summary

The package impersonates the popular date-fns library. Its main module, date-fns-formatter.js, contains a small formatDate shim as a decoy in front of a heavily obfuscated IIFE (obfuscator.io-style rotated string array with a runtime decoder) that runs whenever the module is required. The IIFE creates a hidden directory under os.homedir(), writes a package.json declaring axios, better-sqlite3, node-machine-id, and socket.io-client (plus ffi-napi on Windows), invokes npm install (via npm.cmd through cmd.exe on Windows) to fetch those dependencies, decodes and writes a second obfuscated script (main.js) reassembled from a ~200-piece string array containing base64-encoded https:// URL fragments, and spawns node main.js. On Windows a.vbs wrapper is written that uses WScript.Shell.Run(..., 0, False) to launch the second stage hidden and detached. The provisioned second stage (socket.io-client + node-machine-id + ffi-napi) is a persistent WebSocket remote-agent keyed by a stable host fingerprint, enabling remote command execution on the installer's host. The manifest also self-references date-fns-formatter as its own dependency, and the README example is nonsensical, consistent with a cover-story typosquat rather than a broken legitimate package.

Source: amazon-inspector (e9839e9520db45a2a739a415767a8258e15afee65cee71fe5ff41777cbd22450)