MAL-2026-12176

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dateuuidv2/MAL-2026-12176.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12176
Published
2026-08-05T09:16:51Z
Modified
2026-08-05T13:35:18.002954917Z
Summary
Malicious code in dateuuidv2 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1)

The package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO() at require time. That function reads a PORT= value from README.md in the current working directory, uses those digits to reconstruct an AES-256-GCM key/IV, and decrypts a hardcoded ciphertext to recover a C2 URL. It then POSTs the installer's OS platform and release string to that URL, and executes the response body: on Windows it writes the response to %TEMP%/temp<timestamp>.vbs (extension built as '.v'+'b'+'s' to avoid a literal.vbs string) and runs it via childprocess.exec, then unlinks the file. Multiple evasion layers are present: AES-GCM ciphertext for the destination URL, key material sourced from a file the operator is told to seed with a PORT= value, and string-concatenated dropper extension. The advertised UUID functionality is unrelated to any of the network I/O or shell execution behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T09:17:08Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014622",
            "import_time": "2026-08-05T09:28:31.560311463Z",
            "sha256": "4165eefd9d54cf18f222a72424f4c4c5fbce30c6f81d4dfdbea6fac7a050e6ed",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "modified_time": "2026-08-05T09:16:51Z",
            "source": "amazon-inspector",
            "sha256": "fe45b7e605cc8d939075909d39c9b8a392428c4cc1068f23cd201e2ba3817d1b",
            "import_time": "2026-08-05T09:28:31.260749735Z",
            "id": "IN-MAL-2026-014620",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "modified_time": "2026-08-05T12:56:17Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014815",
            "import_time": "2026-08-05T13:08:48.604990554Z",
            "sha256": "a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1",
            "versions": [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dateuuidv2

Package

Name
dateuuidv2
View open source insights on deps.dev
Purl
pkg:npm/dateuuidv2

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "dateuuidv2-1.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-2PKrZz2bksFFuSueHI4joYnKva+SU/NFw+Ncn8napVxhFGWetAbPMjQkLRAk54Q9erCQMX0hYRPCJ1G3t5lCtQ==",
                "sha1": "668c794106119c1daaf19a69db106cd1c773072f"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "03f175d06567b2538ff5637057a2400ef69fd122391281e5ffec68812fea664d4a2ecc",
            "sha256": "264ebd098c35f83ad7461fe83c8fa9a3135fe5aaef4393e1455ef01a886a67fa",
            "path": "lib/store.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dateuuidv2/MAL-2026-12176.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]