datefmt-util-helpernpm
Advisory published Updated
datefmt-util-helper is a confirmed malicious npm package (MAL-2026-13978) that opens a backdoor for remote access (malicious versions 1.0.0, 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in datefmt-util-helper (npm)
What this malware does
Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node postinstall.js'; postinstall.js hardcodes VPS = '8.135.48.40' and PORT = 4444 and runs execSync of a python3 -c payload that opens a socket to that host and invokes pty.spawn('/bin/bash'), with fallback branches using python3 subprocess and a Node net + child_process.spawn('/bin/bash') chain. Runs automatically during npm install, giving the remote host full interactive shell control on the installer's machine as the installing user. index.js implements a trivial date formatter as cover (a source comment translates to 'disguised as a normal date-formatting tool'); the library surface exists only to legitimize the package.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Search your lockfiles and build artifacts for datefmt-util-helper (2 malicious versions).
If you installed it — respond
datefmt-util-helper establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If datefmt-util-helper was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks datefmt-util-helper-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.