Malicious code in date-fmt-helper-xz (npm)

The npm package date-fmt-helper-xz was distributed with malicious code embedded in a postinstall.js script that executes automatically during npm install. The script establishes a reverse shell connection to a hardcoded remote host at 8.135.48.40 on port 4444, granting the attacker interactive shell access to the installer's machine.\n\nThe malicious script uses multiple fallback mechanisms to maximize success across different environments, including direct TCP connections via /bin/tcp, bash /dev/tcp, and python3 pty.spawn. If all shell attempts fail, the script sends HTTP GET requests to the same attacker host (http://8.135.48.40/shell/failed and /shell/error) to report the failure and error details.\n\nThe package advertises legitimate date formatting functionality, but the reverse shell capability is entirely unrelated to any stated purpose. This represents a classic supply chain attack where a malicious package is published to a public registry to compromise installer systems.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages project (GitHub advisory GHSA-3553-96xv-fjg2).