{"id":"MAL-2026-12176","summary":"Malicious code in dateuuidv2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1)\nThe package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO() at require time. That function reads a PORT= value from README.md in the current working directory, uses those digits to reconstruct an AES-256-GCM key/IV, and decrypts a hardcoded ciphertext to recover a C2 URL. It then POSTs the installer's OS platform and release string to that URL, and executes the response body: on Windows it writes the response to %TEMP%/temp_\u003ctimestamp\u003e.vbs (extension built as '.v'+'b'+'s' to avoid a literal.vbs string) and runs it via child_process.exec, then unlinks the file. Multiple evasion layers are present: AES-GCM ciphertext for the destination URL, key material sourced from a file the operator is told to seed with a PORT= value, and string-concatenated dropper extension. The advertised UUID functionality is unrelated to any of the network I/O or shell execution behavior.\n","modified":"2026-08-05T13:35:18.002954917Z","published":"2026-08-05T09:16:51Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.1"],"id":"IN-MAL-2026-014622","import_time":"2026-08-05T09:28:31.560311463Z","modified_time":"2026-08-05T09:17:08Z","sha256":"4165eefd9d54cf18f222a72424f4c4c5fbce30c6f81d4dfdbea6fac7a050e6ed","source":"amazon-inspector"},{"import_time":"2026-08-05T09:28:31.260749735Z","modified_time":"2026-08-05T09:16:51Z","sha256":"fe45b7e605cc8d939075909d39c9b8a392428c4cc1068f23cd201e2ba3817d1b","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-014620"},{"sha256":"a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-014815","import_time":"2026-08-05T13:08:48.604990554Z","modified_time":"2026-08-05T12:56:17Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dateuuidv2/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/dateuuidv2/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/dateuuidv2/v/1.0.2"}],"affected":[{"package":{"name":"dateuuidv2","ecosystem":"npm","purl":"pkg:npm/dateuuidv2"},"versions":["1.0.1","1.0.0","1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"dateuuidv2-1.0.1.tgz","hashes":{"sha1":"668c794106119c1daaf19a69db106cd1c773072f","sha512_sri":"sha512-2PKrZz2bksFFuSueHI4joYnKva+SU/NFw+Ncn8napVxhFGWetAbPMjQkLRAk54Q9erCQMX0hYRPCJ1G3t5lCtQ=="}}],"evidence_files":[{"tlsh":"03f175d06567b2538ff5637057a2400ef69fd122391281e5ffec68812fea664d4a2ecc","path":"lib/store.js","sha256":"264ebd098c35f83ad7461fe83c8fa9a3135fe5aaef4393e1455ef01a886a67fa"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dateuuidv2/MAL-2026-12176.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}