Malicious code in simple-date-formatter-new-11 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042) Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script in package.json curls cloud instance-metadata endpoints (Alibaba 100.100.100.200, AWS 169.254.169.254, and Tencent Cloud) and a /data/ listing, writes them to /tmp, and POSTs the concatenated contents to an attacker-controlled OAST collector at pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/metadata — harvesting cloud IAM/instance credentials from any cloud VM or CI runner that installs the package. Separately, index.js (the package main) enumerates ~/.ssh on require, packages the username, platform, and key filenames as JSON, and POSTs the payload over HTTPS to the hardcoded remote host 124.221.154.135:443/post, so importing the module leaks SSH key metadata to a fixed attacker endpoint. The advertised formatDate functionality is a stub unrelated to the exfiltration paths.
MAL-2026-17158
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17158
simple-date-formatter-new-11
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "simple-date-formatter-new-11",
"purl": "pkg:npm/simple-date-formatter-new-11",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-new-11/MAL-2026-17158.json",
"indicators": {
"evidence_files": [
{
"path": "package.json",
"tlsh": "2001c2c8b651ad735fc29ab8d2a6070e6910fd471b807e05a3962cf44f8d9b1a07e70e",
"sha256": "3487cd5e35dea398c05702c8eb92af3f3453bdae95288908bbe759353b38f04d"
},
{
"path": "index.js",
"tlsh": "8cc08c94a716b2866326122096a74100be5cc2300b9a6a62b88ec0c00144c12805ef8c",
"sha256": "1d5404dbbd7f6a35142bc11e276bcff7b334f927a198399e6b0d9aa09ecfd098"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "648c565903ac3d6b3d7f5cbf4472950cf2fcba70",
"sha512_sri": "sha512-ZNWdXzoX9iAOsIEqAHFWoh0sriEHRCyRA09FTixKoEwSOd31o7TWjfXNkGG94B2r7IbXPPKipPwKtr8YMVHZgQ=="
},
"filename": "simple-date-formatter-new-11-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #13781 · Revision 1
- Added to Heist Feed
- Publisher date