{"id":"MAL-2026-12198","summary":"Malicious code in simple-date-formatter-new-7 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a09ab26676285be9c12d5c7ecfef65a0f0ebf32cb0324a83d3249c28674a1824)\nPackage is advertised as a date-formatting utility but its `postinstall` script probes an internal-range Kubernetes API (10.45.196.138:8080, endpoints /version, /api, /api/v1/namespaces, /api/v1/pods, /api/v1/secrets, /api/v1/nodes plus two adjacent hosts) and POSTs the concatenated responses to an out-of-band collector at safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo11. Runs automatically on `npm install`. The tarball also ships a `postinstall.js` containing a `getSSHKeys()` function that enumerates `~/.ssh` and POSTs a JSON payload with the directory listing, username, and platform to a hardcoded remote IP 124.221.154.135:443/post over HTTPS. The advertised purpose (`formatDate()` in index.js) is a thin cover story unrelated to the shipped install-time behavior.\n","modified":"2026-08-05T10:06:19.398292660Z","published":"2026-08-05T08:48:17Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.0"],"id":"IN-MAL-2026-014423","import_time":"2026-08-05T09:28:09.504924427Z","modified_time":"2026-08-05T08:48:17Z","sha256":"a09ab26676285be9c12d5c7ecfef65a0f0ebf32cb0324a83d3249c28674a1824","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-date-formatter-new-7/v/1.0.0"}],"affected":[{"package":{"name":"simple-date-formatter-new-7","ecosystem":"npm","purl":"pkg:npm/simple-date-formatter-new-7"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"0487978c1b7fc0fd92c23a7a382b7bf18211747151ec855a5951fff4fc2f390f","tlsh":"8f2105c8f260ac73574acb86db632bd79953409b1d952c0cc9c34d28ea08be165fd726","path":"package.json"},{"path":"postinstall.js","sha256":"f2be6940c08d36a7f1ce83d5fe16fefd8c14edda5d124e0f6406725beb5020ef","tlsh":"273165d558f9cd3007778685639b91263102fe13650ee940f3c807a51fe9a5449f2dee"}],"package_integrity":[{"filename":"simple-date-formatter-new-7-1.0.0.tgz","hashes":{"sha1":"731a0aaf174a7645111ad68e0f5da23d796f104a","sha512_sri":"sha512-8RCyTcJktjapgN5dIfiFXhq0SAA1T8u0YB6Mni9pHxKoC0eljQLoBAmzeezFL0muT87i4REVVFn9rsvjfb6Kgw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-new-7/MAL-2026-12198.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}