MAL-2026-10101

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ce3951661e57807f08fd4dcbf281c14dd1e596907e1a356a3ec503e45fe3b8af) The package advertises itself as a lightweight date-formatting utility but its postinstall lifecycle script executes the `id` command and transmits the output (installer uid/gid/groups) to a hardcoded bare-IP endpoint at http://155.190.124.243:6788/?cmd_output=<encoded>. Delivery is attempted through three redundant transports (node http.get, curl, wget) with swallowed errors to maximize successful exfiltration. The beacon also gives the operator installer IP, User-Agent, and host identity for follow-on targeting. This behavior fires automatically on `npm install`, is entirely unrelated to the declared date-utility purpose, and uses plain HTTP to a bare IP with no legitimate justification. The package name and generic description mimic well-known date helpers (date-fns, dayjs) while the author field is a self-referential placeholder, consistent with a disguised dropper targeting incidental installers.