MAL-2026-11543

    Dashboard / Malicious Package / MAL-2026-11543

    MAL-2026-11543

    Published: 4 Aug 2026Last Modified: 4 Aug 2026

    Summary: Malicious code in simple-date-formatter-new-5 (npm)

    Details: Source: amazon-inspector (204253c08cc90b592f9c086ada633879141aee2bdf27e7286007c709f3b866ab) Package advertised as a date-formatting utility performs supply-chain attack behavior. package.json declares a postinstall shell one-liner that, on npm install, collects kernel version, IP addresses, Kubernetes API probes, cloud instance metadata (AWS 169.254.169.254 and Alibaba 100.100.100.200), an internal /24 TCP scan, ARP/DNS data, and a listing of /var/run/secrets/kubernetes.io/serviceaccount/, then POSTs the aggregated output via curl to http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo9. The main module (index.js) additionally enumerates ~/.ssh for key files on require() and issues an HTTPS POST containing the directory listing plus username and platform to hardcoded IP 124.221.154.135:443/post. The advertised formatDate export is a trivial cover for the exfiltration code paths.

    References: https://www.npmjs.com/package/simple-date-formatter-new-5/v/1.0.0

    Affected packages

    Package

    Name: simple-date-formatter-new-5

    Purl: pkg:npm/simple-date-formatter-new-5

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0