simple-date-formatter-new-6

{"modified":"2026-08-05T08:48:31Z","published":"2026-08-05T08:48:31Z","schema_version":"1.7.4","id":"MAL-2026-12197","summary":"Malicious code in simple-date-formatter-new-6 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6)\npackage.json declares a postinstall script that runs a shell pipeline collecting host identifiers (uname, id), routing and ARP tables, TCP-probe results against internal hosts, cloud instance metadata from 169.254.169.254, and PID 1 cmdline, then POSTs the aggregated output over plain HTTP to safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo10 (an interact.sh OAST callback host). A sibling postinstall.js enumerates ~/.ssh and POSTs a JSON payload including username, platform, and.pub filenames to the hardcoded IP 124.221.154.135:443/post. Both behaviors fire as install-time side effects and provide the publisher with reconnaissance data and cloud-credential-adjacent metadata from any host that runs npm install on this package.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-date-formatter-new-6"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"61b6fdcbef339c4602dc085da4d1eaa944b05030f5aeff75e0a52be237150327","tlsh":"5c212104f2019cb36e8c675cd94e15a6fb0ee40f2e8a3d08a3879c3ce64c5da557c219"},{"path":"postinstall.js","sha256":"f2be6940c08d36a7f1ce83d5fe16fefd8c14edda5d124e0f6406725beb5020ef","tlsh":"273165d558f9cd3007778685639b91263102fe13650ee940f3c807a51fe9a5449f2dee"}],"package_integrity":[{"filename":"simple-date-formatter-new-6-1.0.0.tgz","hashes":{"sha1":"65a9274029d76c6b01be480e3b919f528060ed15","sha512_sri":"sha512-pm7LmwDmEycuSUTmvHAmHS8EUZCfYWG/JIjGXok5pnOZv2JjZdVDcuDkTnVVWbzGL3Q/u1yWNaxxnKgk7BCBFg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-new-6/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014425","import_time":"2026-08-05T09:28:09.664190819Z","modified_time":"2026-08-05T08:48:31Z","sha256":"fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6","source":"amazon-inspector","versions":["1.0.0"]}]}}