{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3039",
  "modified": "2026-07-21T00:00:00Z",
  "published": "2026-07-21T00:00:00Z",
  "summary": "date-format-utils-xz — a metadata harvester that escalated to a reverse shell",
  "details": "The npm package date-format-utils-xz masquerades as a date-formatting utility — its own source comments call it “伪装成正常的日期格式化工具” (“disguised as a normal date formatting tool”). Every published version carries a postinstall hook that runs on npm install. Versions 1.0.0–1.0.3 harvest cloud instance-metadata (Alibaba, AWS/GCP, Tencent) and the full process environment and exfiltrate them to an attacker C2 (a domain zhijiujiu.cn, later the bare IP 8.135.48.40). Version 1.0.4 escalated to a full reverse shell — connecting back to 8.135.48.40:4444 and spawning /bin/sh — i.e. hands-on-keyboard remote code execution on install. The operator then unpublished the entire package from npm to erase the trail.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "date-format-utils-xz"
      },
      "versions": [
        "1.0.0 – 1.0.4 (all versions)"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3039-date-format-utils-xz"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3039",
    "kind": "malware",
    "class": "Install-time metadata/env harvester → reverse shell (1.0.4)",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [
        "8.135.48.40",
        "100.100.100.200",
        "169.254.169.254"
      ],
      "hashes": [
        "sha256:249f72604801ea2bdf436464ec0b8256f198f33d5d1f1ff8b92d507cd6e30a0c",
        "sha256:b976e83c3b45962453580fa1c2b7f840f335cbede96832c089b1789bfeeb79c5",
        "sha256:2adb1a22afb8fac18cf5ce68ebfd2fa1409faea7fef2807f3544cc9e6cd6a4b4",
        "sha256:5d8278b7fa3ff1866f1361c7042c03ad0257e49d33072ed1698d2dd3864d1ec2",
        "sha256:e7612d9538dfbd3e64b491f4c9c14387574e3a298a2d34dd453f75ca8f3a4ae2"
      ],
      "indicators": [
        "C2 domain: zhijiujiu.cn (versions 1.0.0, 1.0.1)",
        "C2 IP: 8.135.48.40 — port 80 harvest (1.0.2, 1.0.3), port 4444 reverse shell (1.0.4)",
        "Harvest paths: /pre?h=&u= · /meta/ali · /meta/aws · /meta/tx · /meta/env · /meta/all · /meta/err",
        "Reverse-shell beacons (1.0.4): /shell/failed · /shell/error",
        "Cloud-metadata probes: 100.100.100.200 (Alibaba) · 169.254.169.254 (AWS/GCP) · metadata.tencentyun.com (Tencent)",
        "1.0.0–1.0.3 postinstall.js: curl to metadata endpoints + `env` dump + POST to C2 · 1.0.4 postinstall.js: net.connect 8.135.48.40:4444 → /bin/sh, bash /dev/tcp fallback, python3 pty fallback · index.js comment \"伪装成正常的日期格式化工具\"",
        "1.0.0: 249f72604801ea2bdf436464ec0b8256f198f33d5d1f1ff8b92d507cd6e30a0c",
        "1.0.1: b976e83c3b45962453580fa1c2b7f840f335cbede96832c089b1789bfeeb79c5",
        "1.0.2: 2adb1a22afb8fac18cf5ce68ebfd2fa1409faea7fef2807f3544cc9e6cd6a4b4",
        "1.0.3: 5d8278b7fa3ff1866f1361c7042c03ad0257e49d33072ed1698d2dd3864d1ec2",
        "1.0.4 (reverse shell): e7612d9538dfbd3e64b491f4c9c14387574e3a298a2d34dd453f75ca8f3a4ae2"
      ]
    }
  }
}