MalwarePublished 13 Aug 2026

datetime-format-xutil (npm) · Malicious Code

Affects datetime-format-xutilSource GCVE Database

Malicious package : remove datetime-format-xutil and rotate any secrets on hosts that installed it.

Data as of 13 Aug 2026, 18:08 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13936

What to do

Remove datetime-format-xutil from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdatetime-format-xutil	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package datetime-format-xutil version 1.0.0 contains malicious code that executes automatically upon installation. The postinstall.js script opens a reverse shell connection to a hardcoded IP address, allowing remote command execution on the installer's host. The package's legitimate date-format functionality is a cover for this backdoor behavior.

Impact

Installing this package version grants an attacker remote shell access on the installer's system, enabling full control and execution of arbitrary commands. This compromises the confidentiality, integrity, and availability of the affected system.

Defensive guidance

Users should avoid installing datetime-format-xutil version 1.0.0. Remove the package immediately if installed and investigate any systems where it was used. Monitor for suspicious network connections to 8.135.48.40 and related indicators. Check vendor advisories or npm security advisories for updates or removal notices.

Summary

The datetime-format-xutil npm package (version 1.0.0) includes a postinstall.js script that runs automatically during npm install. This script attempts to open a TCP connection to 8.135.48.40 on port 4444 and spawns a /bin/sh shell, redirecting its input and output over the socket to provide an interactive remote shell. It uses a bash reverse shell command and falls back to a python3 reverse shell if needed. If the connection fails, error details are sent via HTTP GET requests to the same host. The package's index.js implements date-formatting functionality, which serves as a cover for the malicious backdoor.

References

npmjs.com/package/datetime-format-xutil/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Aug 2026, 18:08 UTC

Technical details

References

Community reviews