simple-date-formatter-util-8

{"modified":"2026-08-05T08:49:33Z","published":"2026-08-05T08:49:33Z","schema_version":"1.7.4","id":"MAL-2026-12206","summary":"Malicious code in simple-date-formatter-util-8 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (28db20339e88b1f37da250a38c838eae62b32419a4c36e806b7c6367671f064c)\npackage.json declares a postinstall lifecycle script that runs curl against the hardcoded bare-IP endpoint http://124.221.154.135/pre, passing the installer's hostname and username as query parameters ($(hostname), $(whoami)). The package presents itself as a trivial date-formatting utility, a purpose that has no need for network I/O at install time. The behavior fires automatically on npm install and leaks installer host identity to a non-first-party attacker-controlled endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-date-formatter-util-8"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"05ac4c2835f3330177959fa1024ecb75ad782a708ba02bae476d986d4ef96598","tlsh":"3fe05c30de208d637bd486645965471fed505a1b86586d04b7071648b75e577407c30e"}],"package_integrity":[{"filename":"simple-date-formatter-util-8-1.0.0.tgz","hashes":{"sha1":"5bd8f52ea0b1b2672088380cfbf865091b9d69c1","sha512_sri":"sha512-/NVLYcxfOv9H4CJ0q0GdIIBQjr8RFfNZF/jwMWWiMRr/L8XrFjVrvcHG4fGohAClwzFT1EFe1ykNyZ8g9esYYA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-util-8/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014432","import_time":"2026-08-05T09:28:10.328934919Z","modified_time":"2026-08-05T08:49:33Z","sha256":"28db20339e88b1f37da250a38c838eae62b32419a4c36e806b7c6367671f064c","source":"amazon-inspector","versions":["1.0.0"]}]}}