The npm package datetime-format-xutil version 1.0.0 contains malicious code that executes automatically upon installation. The postinstall.js script opens a reverse shell connection to a hardcoded IP address, allowing remote command execution on the installer's host. The package's legitimate date-format functionality is a cover for this backdoor behavior.