The npm package datefmt-core-utils version 1.0.0 contains malicious code in its postinstall script. Upon installation, it opens a TCP connection to a hardcoded remote IP and provides an interactive shell to the attacker, effectively allowing remote code execution. The package's advertised date-formatting functionality is a cover for this backdoor behavior.