The 'datetime-toolkit' npm package masquerades as a lightweight datetime utility but contains malicious code in its main entry point 'datetime.js' that triggers data exfiltration on import. It calls a 'collect()' function that serializes the entire process environment, hostname, and timestamp, encrypts this data using AES-256-GCM with a hardcoded key, and sends it via HTTP POST to a remote IP address. The code uses Unicode escapes and reversed string literals to obfuscate critical strings such as the destination URL, bearer token, and encryption key. The package also includes a CLI that performs the same data collection and exfiltration. This results in leakage of sensitive secrets and credentials from any system that installs or runs this package.

Systems that install or run the 'datetime-toolkit' package are fully compromised as the package exfiltrates environment variables and secrets including CI secrets, cloud credentials, source tokens, and database passwords. This exposure can lead to unauthorized access to cloud resources, source code repositories, databases, and other critical infrastructure. Because the package sends data over unencrypted HTTP, interception is also possible. Removal of the package alone may not fully remediate the compromise as attackers may have established persistence.

Remove the 'datetime-toolkit' package immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored or accessible on compromised machines using a separate, secure environment. Because the package grants attackers full control, assume the system is compromised and perform a thorough incident response including forensic analysis and system rebuild if necessary. No official patch or fix is available; the package itself is malicious and should be avoided entirely.