The npm package dateuuidv2, advertised as a UUID v7 generator, contains malicious code that executes at require time. It reads a PORT= value from a README.md file to reconstruct an AES-256-GCM key and decrypt a hardcoded ciphertext to obtain a command-and-control (C2) URL. The package then sends system information to this URL and executes the response as a script on Windows systems. This behavior is unrelated to the advertised UUID functionality and includes multiple evasion techniques.