dateuuidv2

{"schema_version":"1.7.4","id":"MAL-2026-12176","published":"2026-08-05T09:16:51Z","modified":"2026-08-05T13:10:39.699430579Z","summary":"Malicious code in dateuuidv2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1)\nThe package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO() at require time. That function reads a PORT= value from README.md in the current working directory, uses those digits to reconstruct an AES-256-GCM key/IV, and decrypts a hardcoded ciphertext to recover a C2 URL. It then POSTs the installer's OS platform and release string to that URL, and executes the response body: on Windows it writes the response to %TEMP%/temp_<timestamp>.vbs (extension built as '.v'+'b'+'s' to avoid a literal.vbs string) and runs it via child_process.exec, then unlinks the file. Multiple evasion layers are present: AES-GCM ciphertext for the destination URL, key material sourced from a file the operator is told to seed with a PORT= value, and string-concatenated dropper extension. The advertised UUID functionality is unrelated to any of the network I/O or shell execution behavior.\n","affected":[{"package":{"name":"dateuuidv2","ecosystem":"npm"},"versions":["1.0.1","1.0.0","1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/store.js","sha256":"264ebd098c35f83ad7461fe83c8fa9a3135fe5aaef4393e1455ef01a886a67fa","tlsh":"03f175d06567b2538ff5637057a2400ef69fd122391281e5ffec68812fea664d4a2ecc"}],"package_integrity":[{"filename":"dateuuidv2-1.0.1.tgz","hashes":{"sha1":"668c794106119c1daaf19a69db106cd1c773072f","sha512_sri":"sha512-2PKrZz2bksFFuSueHI4joYnKva+SU/NFw+Ncn8napVxhFGWetAbPMjQkLRAk54Q9erCQMX0hYRPCJ1G3t5lCtQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dateuuidv2/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/dateuuidv2/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/dateuuidv2/v/1.0.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014622","import_time":"2026-08-05T09:28:31.560311463Z","modified_time":"2026-08-05T09:17:08Z","sha256":"4165eefd9d54cf18f222a72424f4c4c5fbce30c6f81d4dfdbea6fac7a050e6ed","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-014620","import_time":"2026-08-05T09:28:31.260749735Z","modified_time":"2026-08-05T09:16:51Z","sha256":"fe45b7e605cc8d939075909d39c9b8a392428c4cc1068f23cd201e2ba3817d1b","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-014815","import_time":"2026-08-05T13:08:48.604990554Z","modified_time":"2026-08-05T12:56:17Z","sha256":"a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1","source":"amazon-inspector","versions":["1.0.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}