The datefmt-pro npm package includes a postinstall.js script that runs automatically upon installation. This script executes system commands (hostname, whoami, uname -a, pwd) and enumerates non-internal IPv4 network interfaces using os.networkInterfaces(). It then sends the collected data as JSON via an HTTP POST request to a hardcoded IP address (http://129.204.76.212:9999/rce-poc). The main index.js file contains only a trivial date-formatting stub to disguise the malicious payload. The package name and advertised functionality are designed to appear legitimate, facilitating installation and execution of the reconnaissance beacon.

The malicious postinstall script leaks sensitive host information including system identity and network details to an external attacker-controlled server over unencrypted HTTP. This reconnaissance data could be used for further targeted attacks or exploitation. The compromise occurs at install time without user consent or awareness. No direct code execution beyond data collection and exfiltration is described.

Users should avoid installing the datefmt-pro package, especially versions 1.0.0, 1.0.1, and 1.0.2. Since no patch or official fix is indicated, remediation involves removing the package if installed and auditing systems for any unauthorized data exfiltration. Use trusted package sources and verify package authenticity before installation. Monitor for similar malicious packages that use deceptive names and postinstall scripts.