MAL-2026-12175

    Dashboard / Malicious Package / MAL-2026-12175

    MAL-2026-12175

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in datefmt-pro (npm)

    Details: Source: amazon-inspector (addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787) datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall entry runs postinstall.js on npm install, which uses child_process.execSync to run hostname, whoami, uname -a, and pwd, and calls os.networkInterfaces() to enumerate non-internal IPv4 addresses. It then POSTs the collected identity and internal network information as JSON over plain HTTP to the hardcoded bare-IP endpoint http://129.204.76.212:9999/rce-poc. index.js contains only a trivial date-formatting stub whose in-source comments state it exists to make the package look like a real date library while the payload lives in postinstall.js. The package name imitates a plausible utility to attract installers via typo/trust; the advertised purpose does not require any host reconnaissance or outbound network activity at install time.

    References: https://www.npmjs.com/package/datefmt-pro/v/1.0.2, https://www.npmjs.com/package/datefmt-pro/v/1.0.0, https://www.npmjs.com/package/datefmt-pro/v/1.0.1

    Affected packages

    Package

    Name: datefmt-pro

    Purl: pkg:npm/datefmt-pro

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.2
    1.0.0
    1.0.1