datefmt-util-helper

{"modified":"2026-08-13T21:22:58Z","published":"2026-08-13T21:09:09Z","schema_version":"1.7.4","id":"MAL-2026-13978","summary":"Malicious code in datefmt-util-helper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb)\nPackage presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node postinstall.js'; postinstall.js hardcodes VPS = '8.135.48.40' and PORT = 4444 and runs execSync of a python3 -c payload that opens a socket to that host and invokes pty.spawn('/bin/bash'), with fallback branches using python3 subprocess and a Node net + child_process.spawn('/bin/bash') chain. Runs automatically during `npm install`, giving the remote host full interactive shell control on the installer's machine as the installing user. index.js implements a trivial date formatter as cover (a source comment translates to 'disguised as a normal date-formatting tool'); the library surface exists only to legitimize the package.\n","affected":[{"package":{"ecosystem":"npm","name":"datefmt-util-helper"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"26fcaa78b7a6707b39d80122863ca90e2e7d39302810c1c209f9a1e0f327cff3","tlsh":"f911edf553ebe238efba20b4786e906336a393032782dad8341e47019f535540c92ae1"},{"path":"index.js","sha256":"47d5ef560237b5f8f4c08060ea19a3d340d5ea848828a793ac696ec493cf93f3","tlsh":"e8f028d168e62841632b70ad06870b5599a4f5032d1bf5f1bf0d4d184fcca4da25f7e4"}],"package_integrity":[{"filename":"datefmt-util-helper-1.0.1.tgz","hashes":{"sha1":"45781677a34c9cd86a95d17e20213591d446da0b","sha512_sri":"sha512-BuR9NxxiYX29nEzBd/Xsifg2epWqmr84nG2Yq53ZBp73mmB1oSISSsQo/UHspR+C6oYTb9edL9kM23V8EM7S1w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/datefmt-util-helper/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/datefmt-util-helper/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017689","import_time":"2026-08-13T21:20:57.812087859Z","modified_time":"2026-08-13T21:09:09Z","sha256":"54bb325784300096be6f67b12ea982f2f0ea239013b2ac86779b4fd485636da4","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017690","import_time":"2026-08-13T21:20:57.842640494Z","modified_time":"2026-08-13T21:09:18Z","sha256":"d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb","source":"amazon-inspector","versions":["1.0.0"]}]}}