{"answers":{"affected":"1 open source package ship an affected version, including date-uuid.","exploited":"There is no known exploitation of MAL-2026-6566 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6566 is a malicious package in date-uuid, published on 29 Jun 2026."},"fix_prompt":"MAL-2026-6566 is a malicious package: date-uuid (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6566/ (Markdown: https://insights.sbomify.com/MAL-2026-6566/index.md)","id":"MAL-2026-6566","markdown":"https://insights.sbomify.com/MAL-2026-6566/index.md","name":"MAL-2026-6566","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package advertised as a UUIDv7 helper, but on require()/import it auto-invokes extractDateISO() in bootstrap.js, which reads README.md from process.cwd(), extracts two specific lines (120 and 123), and base64-decodes them after prepending 'aH' and inserting 'Rz' to reconstruct an 'http...' URL (the prefix 'aHR0c' decodes to 'http'). The reconstructed URL is fetched, written to os.tmpdir() as temp_\u003ctimestamp\u003e.vbs (the '.vbs' extension is split as 'v'+'b'+'s' to evade grep), and executed via child_process.exec. The behavior is unrelated to the advertised UUID functionality. Sourcing the payload URL from the caller's README rather than the package source decouples the attacker-controlled destination from the published artifact and enables staged/deniable deployment: a chained attack or a future README edit can change what gets executed without republishing the package. Obfuscation devices (string-splitting the script extension, base64 framing of the URL prefix) co-located with the fetch-and-exec path indicate deliberate evasion intent.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in date-uuid (npm)","id":"MAL-2026-6566","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"date-uuid","purl":"pkg:npm/date-uuid","source":"MAL-2026-6566"}],"products":null,"published":"2026-06-29","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6566/"}