{"id":"MAL-2026-12197","summary":"Malicious code in simple-date-formatter-new-6 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6)\npackage.json declares a postinstall script that runs a shell pipeline collecting host identifiers (uname, id), routing and ARP tables, TCP-probe results against internal hosts, cloud instance metadata from 169.254.169.254, and PID 1 cmdline, then POSTs the aggregated output over plain HTTP to safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo10 (an interact.sh OAST callback host). A sibling postinstall.js enumerates ~/.ssh and POSTs a JSON payload including username, platform, and.pub filenames to the hardcoded IP 124.221.154.135:443/post. Both behaviors fire as install-time side effects and provide the publisher with reconnaissance data and cloud-credential-adjacent metadata from any host that runs npm install on this package.\n","modified":"2026-08-05T10:06:19.095166903Z","published":"2026-08-05T08:48:31Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-014425","import_time":"2026-08-05T09:28:09.664190819Z","modified_time":"2026-08-05T08:48:31Z","sha256":"fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-new-6/v/1.0.0"}],"affected":[{"package":{"name":"simple-date-formatter-new-6","ecosystem":"npm","purl":"pkg:npm/simple-date-formatter-new-6"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"61b6fdcbef339c4602dc085da4d1eaa944b05030f5aeff75e0a52be237150327","tlsh":"5c212104f2019cb36e8c675cd94e15a6fb0ee40f2e8a3d08a3879c3ce64c5da557c219","path":"package.json"},{"sha256":"f2be6940c08d36a7f1ce83d5fe16fefd8c14edda5d124e0f6406725beb5020ef","tlsh":"273165d558f9cd3007778685639b91263102fe13650ee940f3c807a51fe9a5449f2dee","path":"postinstall.js"}],"package_integrity":[{"filename":"simple-date-formatter-new-6-1.0.0.tgz","hashes":{"sha512_sri":"sha512-pm7LmwDmEycuSUTmvHAmHS8EUZCfYWG/JIjGXok5pnOZv2JjZdVDcuDkTnVVWbzGL3Q/u1yWNaxxnKgk7BCBFg==","sha1":"65a9274029d76c6b01be480e3b919f528060ed15"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-new-6/MAL-2026-12197.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}