MAL-2026-12175 Malicious code in datefmt-pro (npm)

datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall entry runs postinstall.js on npm install, which uses child_process.execSync to run hostname, whoami, uname -a, and pwd, and calls os.networkInterfaces() to enumerate non-internal IPv4 addresses. It then POSTs the collected identity and internal network information as JSON over plain HTTP to the hardcoded bare-IP endpoint http://129.204.76.212:9999/rce-poc. index.js contains only a trivial date-formatting stub whose in-source comments state it exists to make the package look like a real date library while the payload lives in postinstall.js. The package name imitates a plausible utility to attract installers via typo/trust; the advertised purpose does not require any host reconnaissance or outbound network activity at install time.