MAL-2026-14032
Malicious code in datefmt-simple-utils (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9) datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fires automatically on npm install. postinstall.js connects a TCP socket to the hardcoded remote host 8.135.48.40 on port 4444 and attaches an interactive /bin/bash to that socket, giving the remote endpoint full command execution on the installer's machine. Three fallback techniques target the same host: a python3 pty.spawn reverse shell, a python3 subprocess-based variant, and a Node net.connect + spawn('/bin/bash', ['-i']) variant. The advertised date-formatting purpose is a cover story; no such functionality is wired into the install-time code path.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for datefmt-simple-utils (npm). Pin to a known-safe version or switch to an alternative.