simple-date-formatter-new-5

{"modified":"2026-08-04T22:05:23Z","published":"2026-08-04T22:05:23Z","schema_version":"1.7.4","id":"MAL-2026-11543","summary":"Malicious code in simple-date-formatter-new-5 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (204253c08cc90b592f9c086ada633879141aee2bdf27e7286007c709f3b866ab)\nPackage advertised as a date-formatting utility performs supply-chain attack behavior. package.json declares a postinstall shell one-liner that, on npm install, collects kernel version, IP addresses, Kubernetes API probes, cloud instance metadata (AWS 169.254.169.254 and Alibaba 100.100.100.200), an internal /24 TCP scan, ARP/DNS data, and a listing of /var/run/secrets/kubernetes.io/serviceaccount/, then POSTs the aggregated output via curl to http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo9. The main module (index.js) additionally enumerates ~/.ssh for key files on require() and issues an HTTPS POST containing the directory listing plus username and platform to hardcoded IP 124.221.154.135:443/post. The advertised formatDate export is a trivial cover for the exfiltration code paths.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-date-formatter-new-5"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"965ce6eabe579444ceffd11e37f9dbb1276312d03ee79ad4b018f053f1dd129b","tlsh":"e9210c98f060ac33af8dda19de23168bb647948f1eb53d1cc5c38c2c864cbe1157c665"},{"path":"index.js","sha256":"1d5404dbbd7f6a35142bc11e276bcff7b334f927a198399e6b0d9aa09ecfd098","tlsh":"8cc08c94a716b2866326122096a74100be5cc2300b9a6a62b88ec0c00144c12805ef8c"}],"package_integrity":[{"filename":"simple-date-formatter-new-5-1.0.0.tgz","hashes":{"sha1":"90cb2d0e3ea44253400435aca5ad26d7796a7d94","sha512_sri":"sha512-IbE1yMMMGyXoalQPvl8rWhltIx7mHHM7E8rt1IUZRbQ1TBG6nnhJwfsj17cs3LrLzW/3IHBjP+cM7TG3/EyzfA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-new-5/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011326","import_time":"2026-08-04T22:30:11.06936734Z","modified_time":"2026-08-04T22:05:23Z","sha256":"204253c08cc90b592f9c086ada633879141aee2bdf27e7286007c709f3b866ab","source":"amazon-inspector","versions":["1.0.0"]}]}}