{"answers":{"affected":"1 open source package ship an affected version, including dateuuidv2.","exploited":"There is no known exploitation of MAL-2026-12176 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12176 is a malicious package in dateuuidv2, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12176 is a malicious package: dateuuidv2 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12176/ (Markdown: https://insights.sbomify.com/MAL-2026-12176/index.md)","id":"MAL-2026-12176","markdown":"https://insights.sbomify.com/MAL-2026-12176/index.md","name":"MAL-2026-12176","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO() at require time. That function reads a PORT= value from README.md in the current working directory, uses those digits to reconstruct an AES-256-GCM key/IV, and decrypts a hardcoded ciphertext to recover a C2 URL. It then POSTs the installer's OS platform and release string to that URL, and executes the response body: on Windows it writes the response to %TEMP%/temp_\u003ctimestamp\u003e.vbs (extension built as '.v'+'b'+'s' to avoid a literal.vbs string) and runs it via child_process.exec, then unlinks the file. Multiple evasion layers are present: AES-GCM ciphertext for the destination URL, key material sourced from a file the operator is told to seed with a PORT= value, and string-concatenated dropper extension. The advertised UUID functionality is unrelated to any of the network I/O or shell execution behavior.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in dateuuidv2 (npm)","id":"MAL-2026-12176","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"dateuuidv2","purl":"pkg:npm/dateuuidv2","source":"MAL-2026-12176"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12176/"}