MAL-2026-12176 Malicious code in dateuuidv2 (npm)

The package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO() at require time. That function reads a PORT= value from README.md in the current working directory, uses those digits to reconstruct an AES-256-GCM key/IV, and decrypts a hardcoded ciphertext to recover a C2 URL. It then POSTs the installer's OS platform and release string to that URL, and executes the response body: on Windows it writes the response to %TEMP%/temp_<timestamp>.vbs (extension built as '.v'+'b'+'s' to avoid a literal.vbs string) and runs it via child_process.exec, then unlinks the file. Multiple evasion layers are present: AES-GCM ciphertext for the destination URL, key material sourced from a file the operator is told to seed with a PORT= value, and string-concatenated dropper extension. The advertised UUID functionality is unrelated to any of the network I/O or shell execution behavior.