MAL-2026-12176

Dashboard / Malicious Package / MAL-2026-12176

MAL-2026-12176

Summary: Malicious code in dateuuidv2 (npm)

Details: Source: amazon-inspector (a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1) The package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO() at require time. That function reads a PORT= value from README.md in the current working directory, uses those digits to reconstruct an AES-256-GCM key/IV, and decrypts a hardcoded ciphertext to recover a C2 URL. It then POSTs the installer's OS platform and release string to that URL, and executes the response body: on Windows it writes the response to %TEMP%/temp_<timestamp>.vbs (extension built as '.v'+'b'+'s' to avoid a literal.vbs string) and runs it via child_process.exec, then unlinks the file. Multiple evasion layers are present: AES-GCM ciphertext for the destination URL, key material sourced from a file the operator is told to seed with a PORT= value, and string-concatenated dropper extension. The advertised UUID functionality is unrelated to any of the network I/O or shell execution behavior.

References: https://www.npmjs.com/package/dateuuidv2/v/1.0.1, https://www.npmjs.com/package/dateuuidv2/v/1.0.0, https://www.npmjs.com/package/dateuuidv2/v/1.0.2