date-fns-formatter@1.3.8

Analysis

date-fns-formatter@1.3.8 is a trojanized clone of the legitimate date-fns-formatter package. On require, the obfuscated main module creates a temporary directory, writes an obfuscated payload (main.js) and a VBScript, and writes a package.json declaring dependencies axios, better-sqlite3, node-machine-id, and socket[.]io-client. It then runs `npm install` in that directory and executes the payload both via `node main.js` and via cmd.exe invoking the VBScript (detached, hidden window). The bundled dependency set indicates browser-database harvesting (better-sqlite3), machine fingerprinting (node-machine-id), command-and-control over socket[.]io, and HTTP exfiltration (axios). The payload is obfuscated with a large encoded string array and a custom base64 decoder; no C2 endpoint is visible in the static code.