simple-date-formatter-new-15

{"modified":"2026-09-24T13:16:33Z","published":"2026-09-24T13:16:33Z","schema_version":"1.7.4","id":"MAL-2026-17161","summary":"Malicious code in simple-date-formatter-new-15 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0)\nThe package's package.json postinstall script curls cloud instance-metadata endpoints (AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential, Alibaba/Tencent metadata at metadata.tencentyun.com and 169.254.0.23) into /tmp files and POSTs their concatenated contents plus `ls -la /data/` output to a remote collector (placeholder host YOUR_BURP_SERVER). The tarball additionally ships postinstall.js containing getSSHKeys(), which reads ~/.ssh from the installer's home directory along with username/platform metadata and POSTs the payload over HTTPS to a hardcoded bare IP 124.221.154.135:443/post. Installing the package runs the lifecycle exfiltration automatically; the SSH-key harvester is bundled dropper code aligned with the same intent. The trivial 'date formatter' name and the presence of a placeholder collector indicate a PoC/typosquat stub in an ongoing credential-theft campaign.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-date-formatter-new-15"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"22f579f6a663f550778e306a146c61583c10f45bb70b267fb898a28fa8c1a54e","tlsh":"f601ce98b651a9730fc68b79d26a030aa510fd471ac07e0992961cf84ece9b1a17c70d"},{"path":"postinstall.js","sha256":"f2be6940c08d36a7f1ce83d5fe16fefd8c14edda5d124e0f6406725beb5020ef","tlsh":"273165d558f9cd3007778685639b91263102fe13650ee940f3c807a51fe9a5449f2dee"}],"package_integrity":[{"filename":"simple-date-formatter-new-15-1.0.0.tgz","hashes":{"sha1":"c2f40d1a905a456ff741306488cca524020a4df3","sha512_sri":"sha512-//gaNGAaREIYH7EdTHTEIYfsiO0cIT/cDx/eqfzv8mIEsg6Rr7Oe52ZZe0k/3mPWNZYTUtFveI4EX6epbnBwdw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-new-15/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020506","import_time":"2026-09-24T13:18:04.389484288Z","modified_time":"2026-09-24T13:16:33Z","sha256":"005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0","source":"amazon-inspector","versions":["1.0.0"]}]}}