datefmt-util-helper@1.0.0

Analysis

The package's postinstall hook (postinstall.js) opens a reverse shell on install: it connects to 8[.]135[.]48[.]40:4444 and spawns an interactive /bin/bash, using three fallback methods (python3 PTY, python3 subprocess, and a Node net socket). The package otherwise contains only a trivial date-formatting stub; its real behaviour is establishing a remote command shell on the installing machine.