simple-date-formatter-new-11

{"modified":"2026-09-24T13:16:23Z","published":"2026-09-24T13:16:23Z","schema_version":"1.7.4","id":"MAL-2026-17158","summary":"Malicious code in simple-date-formatter-new-11 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042)\nPackage presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script in package.json curls cloud instance-metadata endpoints (Alibaba 100.100.100.200, AWS 169.254.169.254, and Tencent Cloud) and a /data/ listing, writes them to /tmp, and POSTs the concatenated contents to an attacker-controlled OAST collector at pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/metadata — harvesting cloud IAM/instance credentials from any cloud VM or CI runner that installs the package. Separately, index.js (the package main) enumerates ~/.ssh on require, packages the username, platform, and key filenames as JSON, and POSTs the payload over HTTPS to the hardcoded remote host 124.221.154.135:443/post, so importing the module leaks SSH key metadata to a fixed attacker endpoint. The advertised formatDate functionality is a stub unrelated to the exfiltration paths.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-date-formatter-new-11"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"3487cd5e35dea398c05702c8eb92af3f3453bdae95288908bbe759353b38f04d","tlsh":"2001c2c8b651ad735fc29ab8d2a6070e6910fd471b807e05a3962cf44f8d9b1a07e70e"},{"path":"index.js","sha256":"1d5404dbbd7f6a35142bc11e276bcff7b334f927a198399e6b0d9aa09ecfd098","tlsh":"8cc08c94a716b2866326122096a74100be5cc2300b9a6a62b88ec0c00144c12805ef8c"}],"package_integrity":[{"filename":"simple-date-formatter-new-11-1.0.0.tgz","hashes":{"sha1":"648c565903ac3d6b3d7f5cbf4472950cf2fcba70","sha512_sri":"sha512-ZNWdXzoX9iAOsIEqAHFWoh0sriEHRCyRA09FTixKoEwSOd31o7TWjfXNkGG94B2r7IbXPPKipPwKtr8YMVHZgQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-new-11/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020505","import_time":"2026-09-24T13:18:04.311547525Z","modified_time":"2026-09-24T13:16:23Z","sha256":"10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042","source":"amazon-inspector","versions":["1.0.0"]}]}}