MAL-2026-13946 Malicious code in date-fmt-helper-xz (npm)

date-fmt-helper-xz ships a postinstall.js that runs automatically on npm install. The script opens a TCP connection to the hardcoded remote host 8.135.48.40 on port 4444 and pipes /bin/sh stdio over the socket, granting the remote party interactive shell access on the installer's machine. Bash /dev/tcp and python3 pty.spawn fallbacks are included to maximize the chance the shell succeeds across environments. On failure of the shell paths, the script issues an HTTP GET to http://8.135.48.40/shell/failed and /shell/error with the error message, confirming the same host as attacker command-and-control. The package advertises date formatting; the reverse shell is unrelated to any legitimate functionality.