date-kit-lite

{"modified":"2026-07-09T23:10:21Z","published":"2026-07-09T23:10:21Z","schema_version":"1.7.4","id":"MAL-2026-10101","summary":"Malicious code in date-kit-lite (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ce3951661e57807f08fd4dcbf281c14dd1e596907e1a356a3ec503e45fe3b8af)\nThe package advertises itself as a lightweight date-formatting utility but its postinstall lifecycle script executes the `id` command and transmits the output (installer uid/gid/groups) to a hardcoded bare-IP endpoint at http://155.190.124.243:6788/?cmd_output=<encoded>. Delivery is attempted through three redundant transports (node http.get, curl, wget) with swallowed errors to maximize successful exfiltration. The beacon also gives the operator installer IP, User-Agent, and host identity for follow-on targeting. This behavior fires automatically on `npm install`, is entirely unrelated to the declared date-utility purpose, and uses plain HTTP to a bare IP with no legitimate justification. The package name and generic description mimic well-known date helpers (date-fns, dayjs) while the author field is a self-referential placeholder, consistent with a disguised dropper targeting incidental installers.\n","affected":[{"package":{"ecosystem":"npm","name":"date-kit-lite"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"3268a973540ef67255c402867f3b189b6a5ac912952d49cd408a09fe622f518d","tlsh":"7a01cbee21e163b0a8a358c6db2b2429654be0073a5dafd8bedc47160f5a11843326e4"},{"path":"package.json","sha256":"2692ade90fd34d4a587e4b2660a1daa07915a765c5b0536be3208a8de6f789cb","tlsh":"95e022300922562326c586e6ed124946ad210e23129cbc1823e3512883ceb7a94fd22a"}],"package_integrity":[{"filename":"date-kit-lite-1.0.0.tgz","hashes":{"sha1":"7506b3a805f38f813fd521212472b03b8ca824da","sha512_sri":"sha512-aSjayzJemoS8Wdoh3okmQSf3DZdxj/I5KjWX9r1BRf8yAhp9Nw7gj7zzg1i+P6rq+9eonhrO1hSsN+MAGbKYfw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/date-kit-lite/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009602","import_time":"2026-07-09T23:30:56.403044571Z","modified_time":"2026-07-09T23:10:21Z","sha256":"ce3951661e57807f08fd4dcbf281c14dd1e596907e1a356a3ec503e45fe3b8af","source":"amazon-inspector","versions":["1.0.0"]}]}}