Malicious code in simple-date-formatter-new-15 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0) The package's package.json postinstall script curls cloud instance-metadata endpoints (AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential, Alibaba/Tencent metadata at metadata.tencentyun.com and 169.254.0.23) into /tmp files and POSTs their concatenated contents plus `ls -la /data/` output to a remote collector (placeholder host YOUR_BURP_SERVER). The tarball additionally ships postinstall.js containing getSSHKeys(), which reads ~/.ssh from the installer's home directory along with username/platform metadata and POSTs the payload over HTTPS to a hardcoded bare IP 124.221.154.135:443/post. Installing the package runs the lifecycle exfiltration automatically; the SSH-key harvester is bundled dropper code aligned with the same intent. The trivial 'date formatter' name and the presence of a placeholder collector indicate a PoC/typosquat stub in an ongoing credential-theft campaign.
MAL-2026-17161
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17161
simple-date-formatter-new-15
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "simple-date-formatter-new-15",
"purl": "pkg:npm/simple-date-formatter-new-15",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-new-15/MAL-2026-17161.json",
"indicators": {
"evidence_files": [
{
"path": "package.json",
"tlsh": "f601ce98b651a9730fc68b79d26a030aa510fd471ac07e0992961cf84ece9b1a17c70d",
"sha256": "22f579f6a663f550778e306a146c61583c10f45bb70b267fb898a28fa8c1a54e"
},
{
"path": "postinstall.js",
"tlsh": "273165d558f9cd3007778685639b91263102fe13650ee940f3c807a51fe9a5449f2dee",
"sha256": "f2be6940c08d36a7f1ce83d5fe16fefd8c14edda5d124e0f6406725beb5020ef"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "c2f40d1a905a456ff741306488cca524020a4df3",
"sha512_sri": "sha512-//gaNGAaREIYH7EdTHTEIYfsiO0cIT/cDx/eqfzv8mIEsg6Rr7Oe52ZZe0k/3mPWNZYTUtFveI4EX6epbnBwdw=="
},
"filename": "simple-date-formatter-new-15-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #13780 · Revision 1
- Added to Heist Feed
- Publisher date