MAL-2026-11998
Malicious code in simple-date-formatter-util-7 (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e53aca949f6ef9820b220363a2b0c7df91e36f08ded73165dfe9140a004fd693) Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script that spawns an interactive bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving a remote party command execution on the installer's host immediately after `npm install`. A bundled postinstall.js additionally enumerates the installer's ~/.ssh directory and POSTs the listing along with username and platform metadata to the same host at 124.221.154.135 over HTTPS. Advertised purpose (date formatting) does not require network access, shell execution, or SSH directory reads.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for simple-date-formatter-util-7 (npm). Pin to a known-safe version or switch to an alternative.