MAL-2026-17160
Malicious code in simple-date-formatter-new-14 (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cbe2adf4e9d3b54b33c0e80285a5b0eb4d81dfde75c7a5b7a202ac43793268cd) The package presents itself as a date-formatting utility (index.js is a 160-byte formatDate stub) but the published tarball contains an SSH-key exfiltration payload and an install-time DNS beacon. package.json declares a postinstall lifecycle script that runs 'nslookup 9e954818.log.dnslogs.dpdns.org', causing every installer to beacon a per-package token to attacker-controlled DNS logging infrastructure at install time, leaking installer presence and resolver IP. A sibling postinstall.js reads ~/.ssh (enumerating.pub files and related host/user identifiers) and POSTs the collected data over HTTPS to a hardcoded bare IP endpoint at https://124.221.154.135/post; comments in the file describe SSH key theft and C2 exfiltration. The name-collision between the declared postinstall hook and the stealer filename, combined with the empty author field and typosquat-style package name, is consistent with a disposable supply-chain payload.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for simple-date-formatter-new-14 (npm). Pin to a known-safe version or switch to an alternative.