취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6365312ad1339c7d5539f594b9e472ea3f10401fa356fe49766de887368e87c9)

Package declares a postinstall lifecycle script that, on npm install, fetches a script over plain HTTP from a hardcoded bare IP (http://115.190.124.243:8761/slt on Unix,.../swt on Windows) and immediately executes it — piping to sh on Unix and writing to C:\Users\Public\run.bat via certutil then invoking it on Windows. The package presents itself as date-fns-lite, a lookalike of the popular date-fns library, and ships a benign-looking date-formatting index.js as cover; the actual behavior is an install-time dropper that hands remote code execution to the operator of 115.190.124.243 against every installer. No pinning, no integrity check, no TLS.