MAL-2026-11998
Malicious code in simple-date-formatter-util-7 (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e53aca949f6ef9820b220363a2b0c7df91e36f08ded73165dfe9140a004fd693) Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script that spawns an interactive bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving a remote party command execution on the installer's host immediately after `npm install`. A bundled postinstall.js additionally enumerates the installer's ~/.ssh directory and POSTs the listing along with username and platform metadata to the same host at 124.221.154.135 over HTTPS. Advertised purpose (date formatting) does not require network access, shell execution, or SSH directory reads.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for simple-date-formatter-util-7 (npm). Pin to a known-safe version or switch to an alternative.