Malicious code in datefmt-core-utils (npm)

The npm package datefmt-core-utils was published with malicious code embedded in a postinstall.js script. This script is automatically executed by npm during package installation via the scripts.postinstall hook, without requiring explicit user action.

The postinstall.js payload establishes a TCP connection to a hardcoded remote address (8.135.48.40:4444) and redirects /bin/bash stdio to that socket, granting the attacker an interactive shell on the victim's machine. The malicious script implements three redundant methods to achieve this: Python 3 pty.spawn, Python 3 subprocess, and Node.js net combined with child_process.spawn of '/bin/bash -i'.

The package's legitimate index.js file contained functional date-formatting code, serving as a cover story to evade detection. The malicious behavior was discovered and reported through the OpenSSF's malicious-packages repository.

This incident demonstrates the risk of postinstall scripts in npm packages, which execute with the privileges of the installing user and can perform arbitrary system operations before the package is even used.