simple-date-formatter-util-16

{"modified":"2026-08-05T08:48:40Z","published":"2026-08-05T08:48:40Z","schema_version":"1.7.4","id":"MAL-2026-12204","summary":"Malicious code in simple-date-formatter-util-16 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3d57172cd3c0a47afc03e1a15ca2ead758bb6f5c78a2234d42487d65cb4944c5)\npackage.json declares a postinstall script that runs automatically on `npm install`. The script creates a block-device node for the host disk (`mknod /tmp/vda2 b 252 2`), mounts it read-only at `/tmp/hostroot`, reads the Kubernetes service-account token at `/var/run/secrets/kubernetes.io/serviceaccount/token`, collects host and pod metadata (`/etc/kubernetes`, ARP table, internal work directories), and POSTs the aggregated output via `curl` to `http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo4`. The behavior combines container-escape reconnaissance against a Kubernetes node with credential and host-data exfiltration to an out-of-band interaction domain.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-date-formatter-util-16"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"47eea575378c410807b0712bea4bed05c140f1b8c3d33bc78a73e3dcadb7c5e6","tlsh":"6a11ce41f6508e735acdc9a42c170348b9c2a80f1a1a3d0ce5c7a638a19c6f2c479f47"}],"package_integrity":[{"filename":"simple-date-formatter-util-16-1.0.0.tgz","hashes":{"sha1":"fc7642256a7bef50573cb64d083a8fc07f77b438","sha512_sri":"sha512-WOuKpKDsAoAy/QrLZA+PPYF+KpbYxATNxwPs9iGiAKfcpVl+l1YnrLfCG4Gk/WY5p39WKw84BG7Y+Bxn7/vz1g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-util-16/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014426","import_time":"2026-08-05T09:28:09.747074366Z","modified_time":"2026-08-05T08:48:40Z","sha256":"3d57172cd3c0a47afc03e1a15ca2ead758bb6f5c78a2234d42487d65cb4944c5","source":"amazon-inspector","versions":["1.0.0"]}]}}