date-uuid@1.0.1

Analysis

date-uuid is a trojanized package that masquerades as a UUID v7 generator but silently downloads and executes remote code when required. On import (require('date-uuid')), the entry point lib/bootstrap.js triggers lib/store.js which reads the HOST project's README.md at lines 120 and 123 for markers matching ^api1: and ^api2: patterns. These markers are base64-decoded (with hardcoded prefix and infix affixes) to reconstruct a URL. The package fetches content from that URL, writes it to /tmp/temp_<timestamp>.vbs, executes it via child_process.exec, then deletes it. The C2 URL is steganographically embedded in the victim's own project README, making the attack hard to detect. The package exports a benign UUID API alongside the payload in lib/store.js. Both published versions (1.0.0, 1.0.1) contain this downloader — 1.0.1 adds affix obfuscation to the base64 decoding step.