MAL-2026-12195

    Dashboard / Malicious Package / MAL-2026-12195

    MAL-2026-12195

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in simple-date-formatter-new-3 (npm)

    Details: Source: amazon-inspector (eaef04a98dce874de04a92b580f4f919067a0e492d38dff69a57fc09db1cfe14) The package's `postinstall` script in package.json runs a shell pipeline that collects host and container-runtime information (kernel version via `uname -r`, `/proc/1/cmdline`, `/proc/1/ns`, root filesystem listing, block device listing) and POSTs the output via `curl` to the hardcoded interact.sh-style callback `http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo7`. The same pipeline attempts container-escape actions: creating a cgroup subtree under `/sys/fs/cgroup/esc7`, moving PID 0 into it, `mknod`ing a block device at `/tmp/x17`, and mounting the host root filesystem at `/tmp/hostroot`, with results reported back to the same external endpoint. The tarball also ships a `postinstall.js` that enumerates the installer's `~/.ssh` directory and POSTs the listing plus username/platform to the hardcoded IP `124.221.154.135:443/post`, with in-source comments describing the behavior as SSH-key C2 exfiltration. All of this runs automatically on `npm install` with no user consent. The package name and stated purpose ("date formatter") do not match any of the observed behavior.

    References: https://www.npmjs.com/package/simple-date-formatter-new-3/v/1.0.0

    Affected packages

    Package

    Name: simple-date-formatter-new-3

    Purl: pkg:npm/simple-date-formatter-new-3

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0