dateuuidv2@1.0.0

Analysis

dateuuidv2 is a trojanized clone of a UUID v7 library that ships an encrypted download-and-execute payload. On require(), the package reads a PORT= line from the consuming project's README file, uses characters from that value to reconstruct an AES-256-GCM ciphertext, decrypts it with a hardcoded key (bde1af3b6ad9a44720d32006c8c12f4b6d265271e5d516b780605e10d067393b) and IV (550cdb11cd0fb75664cad82f), and extracts a C2 URL from the decrypted result. It then POSTs the victim's platform and OS release to that URL, writes the response to a temporary file under os.tmpdir() with a .vbs extension, executes the file via child_process.exec, and deletes it after execution.