simple-date-formatter-new-12

{"modified":"2026-09-28T18:08:15Z","published":"2026-09-28T18:08:15Z","schema_version":"1.7.4","id":"MAL-2026-17229","summary":"Malicious code in simple-date-formatter-new-12 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f)\nnpm package simple-date-formatter-new-12@1.0.0 declares a postinstall lifecycle script in package.json that runs automatically on `npm install`. The script uses curl to fetch an internal Baidu host (http://bsrc-ssrf.n.baidu-int.com/...), writes the response to /tmp/bsrc.txt, and POSTs the contents to an attacker-controlled interactsh collector at pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/bsrc. The package's advertised purpose is a trivial date-formatting wrapper (index.js exports a single formatDate function); the SSRF probe and outbound exfiltration are unrelated to that purpose. The name shape (`simple-date-formatter-new-12`), empty author metadata, and OAST beacon are consistent with a dependency-confusion / typosquat probe designed to detect installation inside a target organization and leak internal network responses reachable from the installer's network position to a third-party collector.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-date-formatter-new-12"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"b4d64adc3fc3bb08e95661f461973e58576b1800650da2dba44eff2548dcffa9","tlsh":"3af05c44d6046db357c386fc9a66050e7b01ae1714447d05b3aa08ac839aef641ba30f"}],"package_integrity":[{"filename":"simple-date-formatter-new-12-1.0.0.tgz","hashes":{"sha1":"040d3c85a17f9e618d8e22b6cd60394ef9c7f60f","sha512_sri":"sha512-fKDny5UVQjvfzJkCUcTJ5vw4m/I90MHxhGQd0QvmEVFZKgfVncxB8b1+/Yy9zzxSqrpjyMXg/HSXGPH+SOio5w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-new-12/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020609","import_time":"2026-09-28T18:24:40.812632607Z","modified_time":"2026-09-28T18:08:15Z","sha256":"bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f","source":"amazon-inspector","versions":["1.0.0"]}]}}