simple-date-formatter-new-3

{"modified":"2026-08-05T08:47:59Z","published":"2026-08-05T08:47:59Z","schema_version":"1.7.4","id":"MAL-2026-12195","summary":"Malicious code in simple-date-formatter-new-3 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (eaef04a98dce874de04a92b580f4f919067a0e492d38dff69a57fc09db1cfe14)\nThe package's `postinstall` script in package.json runs a shell pipeline that collects host and container-runtime information (kernel version via `uname -r`, `/proc/1/cmdline`, `/proc/1/ns`, root filesystem listing, block device listing) and POSTs the output via `curl` to the hardcoded interact.sh-style callback `http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo7`. The same pipeline attempts container-escape actions: creating a cgroup subtree under `/sys/fs/cgroup/esc7`, moving PID 0 into it, `mknod`ing a block device at `/tmp/x17`, and mounting the host root filesystem at `/tmp/hostroot`, with results reported back to the same external endpoint. The tarball also ships a `postinstall.js` that enumerates the installer's `~/.ssh` directory and POSTs the listing plus username/platform to the hardcoded IP `124.221.154.135:443/post`, with in-source comments describing the behavior as SSH-key C2 exfiltration. All of this runs automatically on `npm install` with no user consent. The package name and stated purpose (\"date formatter\") do not match any of the observed behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-date-formatter-new-3"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"c1a89f6701f365069f196d5858d51ef88b2f6e51731c965b3e447cb88a6692c3","tlsh":"0f219b51f210aeb349ec82a56c1f4698fa82694f8a967e5cd0df893811c85f640bdf0b"},{"path":"postinstall.js","sha256":"f2be6940c08d36a7f1ce83d5fe16fefd8c14edda5d124e0f6406725beb5020ef","tlsh":"273165d558f9cd3007778685639b91263102fe13650ee940f3c807a51fe9a5449f2dee"}],"package_integrity":[{"filename":"simple-date-formatter-new-3-1.0.0.tgz","hashes":{"sha1":"ec6d01256dcca2b757f541e11d3d87e4d00672c3","sha512_sri":"sha512-j3ERqK/6NK8vicKzcwmCWOpJdkMU2eyAYJmtLWcyKTneOhLpgqN2RASiXitGUNSBLTsjfAIGfFc8adgTSQZKRw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-new-3/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014421","import_time":"2026-08-05T09:28:09.234988562Z","modified_time":"2026-08-05T08:47:59Z","sha256":"eaef04a98dce874de04a92b580f4f919067a0e492d38dff69a57fc09db1cfe14","source":"amazon-inspector","versions":["1.0.0"]}]}}