data-format-helper

{"modified":"2026-08-05T01:41:30Z","published":"2026-08-05T01:02:58Z","schema_version":"1.7.4","id":"MAL-2026-12039","summary":"Malicious code in data-format-helper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (21db9b8662eac789b1523c3f2114daa6a5fd3a2a0c7bbfb58fafdf3b4809c7cd)\nThe package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install and runs shell commands to collect installer/CI identity and secrets, then sends them to an attacker-controlled Burp Collaborator subdomain over plain HTTP. Observed collection includes hostname, whoami/id, sudo -l output, process and network state, GitHub Actions environment (GITHUB_TOKEN, GITHUB_REPOSITORY, GITHUB_ACTOR, RUN_ID and related), and any environment variables matching KEY|TOKEN|SECRET|NPM_TOKEN|AWS_|AZURE|GCP|GITHUB_TOKEN, each base64-encoded and sent via curl to http://pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/. The script additionally probes cloud instance-metadata endpoints for AWS, Aliyun, GCP and Tencent and forwards the responses to the same collector. A separate phase probes the internal hostname tst.woa.com and base64-encodes the response body of an internal flag.html before sending it to the collector, indicating targeted reconnaissance against a specific internal (Tencent) environment consistent with a dependency-confusion decoy. The advertised 'data formatting utilities' description and benign color-helper index.js are cover metadata unrelated to the postinstall behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"data-format-helper"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"b0fd56908ccfeea473ff249ab63aa2d4eb43d34dc160c2f9da94836587a5cb84","tlsh":"cc71f2c4da6cb837333ad550e65a48075e87e8af4eb8ff8158362e20010cb463677a77"},{"path":"package.json","sha256":"a89ccac7d9afddaef91c32acdf10398f48838f4500c21b4e665dfbf9e06aaac2","tlsh":"56e02b10d9218633a9c45ba69da3424b7e311e1e1310bc6d27d7705c838fafa85bf31e"}],"package_integrity":[{"filename":"data-format-helper-1.0.1.tgz","hashes":{"sha1":"4a27eae56bc43f9a4b0342813985c34f2869ddc2","sha512_sri":"sha512-8prHNGGQerlM5lxvufGE9KFIPp7KjlWo9vCrf/OE3mNG2T5ECXhW91dOJZLpVgWLetdjIWCcDFwzMMNJE/GpQw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/data-format-helper/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/data-format-helper/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011483","import_time":"2026-08-05T01:39:30.97120653Z","modified_time":"2026-08-05T01:03:23Z","sha256":"1f06ab5181c32dbe125d9dfe5b9c8f9e4052a060b61acdc04afc886b1a097fa9","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-011482","import_time":"2026-08-05T01:39:30.924102224Z","modified_time":"2026-08-05T01:02:58Z","sha256":"21db9b8662eac789b1523c3f2114daa6a5fd3a2a0c7bbfb58fafdf3b4809c7cd","source":"amazon-inspector","versions":["1.0.0"]}]}}