MAL-2026-12196

    Dashboard / Malicious Package / MAL-2026-12196

    MAL-2026-12196

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in simple-date-formatter-new-4 (npm)

    Details: Source: amazon-inspector (2f5ed3c402677fcfaeac396b55b9db5280445e9b0130133cc311a83f96f2a0de) Package advertises itself as a date-formatting utility but its actual behavior on install is credential theft and internal-network reconnaissance. The `postinstall` script in package.json runs a shell one-liner that probes internal Kubernetes API endpoints, dumps `/etc/resolv.conf` and `ip route`, TCP-scans internal hosts, reads the pod's Kubernetes service-account token from `/var/run/secrets/kubernetes.io/serviceaccount/token`, and POSTs the aggregated output via curl to a hardcoded OAST (interact.sh) collector at http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo8. A bundled `postinstall.js` additionally enumerates `~/.ssh` (listing public keys), collects the local username and platform, and POSTs the JSON to a hardcoded IP 124.221.154.135 over HTTPS; in-file comments describe it as an SSH-key theft C2 demo. The library payload (`index.js`) is a three-line wrapper around `toLocaleDateString`, functioning solely as cover for the install-time attack.

    References: https://www.npmjs.com/package/simple-date-formatter-new-4/v/1.0.0

    Affected packages

    Package

    Name: simple-date-formatter-new-4

    Purl: pkg:npm/simple-date-formatter-new-4

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-12196 | CVE-DB