MAL-2026-13978

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb) Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node postinstall.js'; postinstall.js hardcodes VPS = '8.135.48.40' and PORT = 4444 and runs execSync of a python3 -c payload that opens a socket to that host and invokes pty.spawn('/bin/bash'), with fallback branches using python3 subprocess and a Node net + child_process.spawn('/bin/bash') chain. Runs automatically during `npm install`, giving the remote host full interactive shell control on the installer's machine as the installing user. index.js implements a trivial date formatter as cover (a source comment translates to 'disguised as a normal date-formatting tool'); the library surface exists only to legitimize the package.