datefmt-simple-utils

{"modified":"2026-08-14T14:12:16Z","published":"2026-08-14T14:12:16Z","schema_version":"1.7.4","id":"MAL-2026-14032","summary":"Malicious code in datefmt-simple-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9)\ndatefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall=\"node postinstall.js\", which fires automatically on npm install. postinstall.js connects a TCP socket to the hardcoded remote host 8.135.48.40 on port 4444 and attaches an interactive /bin/bash to that socket, giving the remote endpoint full command execution on the installer's machine. Three fallback techniques target the same host: a python3 pty.spawn reverse shell, a python3 subprocess-based variant, and a Node net.connect + spawn('/bin/bash', ['-i']) variant. The advertised date-formatting purpose is a cover story; no such functionality is wired into the install-time code path.\n","affected":[{"package":{"ecosystem":"npm","name":"datefmt-simple-utils"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"26fcaa78b7a6707b39d80122863ca90e2e7d39302810c1c209f9a1e0f327cff3","tlsh":"f911edf553ebe238efba20b4786e906336a393032782dad8341e47019f535540c92ae1"},{"path":"package.json","sha256":"00ea7a5dcd2f2ea9453b35fbc75c1085231caa34ba22cb7d2edfd9398da465ad","tlsh":"15e0c23a9d415e336bf887a95e274606fa109f1f12284c0b71bb214c47a36b284ae309"}],"package_integrity":[{"filename":"datefmt-simple-utils-1.0.0.tgz","hashes":{"sha1":"dadc78d7daa895de15157a9a7c5f41148a9188cb","sha512_sri":"sha512-3lDhMYy83As355DKdPRaD0APBJJKEScq29htTVOdCXaJAxiYPsbOmh3f0eIS1StW254JWH/f3Kl7aYU1rqjsVQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/datefmt-simple-utils/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017761","import_time":"2026-08-14T14:28:06.920717477Z","modified_time":"2026-08-14T14:12:16Z","sha256":"7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9","source":"amazon-inspector","versions":["1.0.0"]}]}}