MAL-2026-11041

Dashboard / Malicious Package / MAL-2026-11041

MAL-2026-11041

Summary: Malicious code in @daylightqc/date-fmt-lite (npm)

Details: Source: amazon-inspector (62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf) The package declares a postinstall script (postinstall.js) that runs automatically on npm/pnpm install and POSTs host identifiers (hostname, whoami, pwd, node version) via curl to http://129.204.76.212:9999/rce-poc. On require of index.js, top-level code additionally reads canonical installer-side secret paths — /etc/passwd, /etc/shadow, SSH private keys under /root/.ssh and /home/*/.ssh, ~/.npmrc,.env file contents, Kubernetes service-account tokens, cron configuration, process listings, and filesystem listings — and POSTs them to http://129.204.76.212:9999/report. The same code queries cloud instance-metadata endpoints (AWS 169.254.169.254, GCP metadata, AliCloud 100.100.100.200, Tencent metadata.tencentyun.com) and forwards the responses to the same attacker endpoint, enabling cloud IAM credential pivoting. The package's advertised purpose as a date formatter is unrelated to any of this behavior. Source: ossf-package-analysis (70c4984ac7bf7b1e15e3b449e924fb4178a1e5667b0aee8b282bb796bbe9623c) The OpenSSF Package Analysis project identified '@daylightqc/date-fmt-lite' @ 1.1.1 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/@daylightqc/date-fmt-lite/v/1.1.2, https://www.npmjs.com/package/@daylightqc/date-fmt-lite/v/1.0.0, https://www.npmjs.com/package/@daylightqc/date-fmt-lite/v/1.0.1