The npm package datetime-fmt-xutil version 1.0.0 includes a postinstall.js script that, upon installation, opens a TCP connection to the hardcoded IP 8.135.48.40 on port 4444. It pipes the standard input/output of /bin/sh through this socket, effectively granting the remote operator interactive shell access on the installer's machine. If the primary method fails, it attempts to spawn a shell using bash or python3 one-liners. Any failure in establishing the shell connection is beaconed back to the attacker via HTTP GET requests. This malicious behavior is unconditional and triggered automatically during npm install, with the package's date-formatting code serving as a disguise for the reverse shell payload. The hardcoded IP is unrelated to the declared publisher, indicating a supply chain compromise or malicious package upload.

Successful installation of this package version results in the attacker gaining remote interactive shell access on the victim's machine. This allows full control over the system with the privileges of the user running npm install, potentially leading to data theft, system compromise, or further malware deployment. The unconditional execution during installation increases the risk of widespread compromise if the package is used.

No official patch or remediation is currently documented. Users should immediately avoid installing datetime-fmt-xutil version 1.0.0. Remove any installations of this package from systems and audit affected environments for signs of compromise. Use trusted package sources and verify package integrity before installation. Monitor for updates from the package maintainer or npm security advisories for any official fixes or removals. Patch status is not yet confirmed — check the vendor advisory or npm security channels for current remediation guidance.