simple-date-formatter-new-7

{"modified":"2026-08-05T08:48:17Z","published":"2026-08-05T08:48:17Z","schema_version":"1.7.4","id":"MAL-2026-12198","summary":"Malicious code in simple-date-formatter-new-7 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a09ab26676285be9c12d5c7ecfef65a0f0ebf32cb0324a83d3249c28674a1824)\nPackage is advertised as a date-formatting utility but its `postinstall` script probes an internal-range Kubernetes API (10.45.196.138:8080, endpoints /version, /api, /api/v1/namespaces, /api/v1/pods, /api/v1/secrets, /api/v1/nodes plus two adjacent hosts) and POSTs the concatenated responses to an out-of-band collector at safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo11. Runs automatically on `npm install`. The tarball also ships a `postinstall.js` containing a `getSSHKeys()` function that enumerates `~/.ssh` and POSTs a JSON payload with the directory listing, username, and platform to a hardcoded remote IP 124.221.154.135:443/post over HTTPS. The advertised purpose (`formatDate()` in index.js) is a thin cover story unrelated to the shipped install-time behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-date-formatter-new-7"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"0487978c1b7fc0fd92c23a7a382b7bf18211747151ec855a5951fff4fc2f390f","tlsh":"8f2105c8f260ac73574acb86db632bd79953409b1d952c0cc9c34d28ea08be165fd726"},{"path":"postinstall.js","sha256":"f2be6940c08d36a7f1ce83d5fe16fefd8c14edda5d124e0f6406725beb5020ef","tlsh":"273165d558f9cd3007778685639b91263102fe13650ee940f3c807a51fe9a5449f2dee"}],"package_integrity":[{"filename":"simple-date-formatter-new-7-1.0.0.tgz","hashes":{"sha1":"731a0aaf174a7645111ad68e0f5da23d796f104a","sha512_sri":"sha512-8RCyTcJktjapgN5dIfiFXhq0SAA1T8u0YB6Mni9pHxKoC0eljQLoBAmzeezFL0muT87i4REVVFn9rsvjfb6Kgw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-new-7/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014423","import_time":"2026-08-05T09:28:09.504924427Z","modified_time":"2026-08-05T08:48:17Z","sha256":"a09ab26676285be9c12d5c7ecfef65a0f0ebf32cb0324a83d3249c28674a1824","source":"amazon-inspector","versions":["1.0.0"]}]}}