MAL-2026-11543
Malicious code in simple-date-formatter-new-5 (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (204253c08cc90b592f9c086ada633879141aee2bdf27e7286007c709f3b866ab) Package advertised as a date-formatting utility performs supply-chain attack behavior. package.json declares a postinstall shell one-liner that, on npm install, collects kernel version, IP addresses, Kubernetes API probes, cloud instance metadata (AWS 169.254.169.254 and Alibaba 100.100.100.200), an internal /24 TCP scan, ARP/DNS data, and a listing of /var/run/secrets/kubernetes.io/serviceaccount/, then POSTs the aggregated output via curl to http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo9. The main module (index.js) additionally enumerates ~/.ssh for key files on require() and issues an HTTPS POST containing the directory listing plus username and platform to hardcoded IP 124.221.154.135:443/post. The advertised formatDate export is a trivial cover for the exfiltration code paths.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for simple-date-formatter-new-5 (npm). Pin to a known-safe version or switch to an alternative.