MAL-2026-12198
Dashboard / Malicious Package / MAL-2026-12198
MAL-2026-12198
Summary: Malicious code in simple-date-formatter-new-7 (npm)
Details: Source: amazon-inspector (a09ab26676285be9c12d5c7ecfef65a0f0ebf32cb0324a83d3249c28674a1824) Package is advertised as a date-formatting utility but its `postinstall` script probes an internal-range Kubernetes API (10.45.196.138:8080, endpoints /version, /api, /api/v1/namespaces, /api/v1/pods, /api/v1/secrets, /api/v1/nodes plus two adjacent hosts) and POSTs the concatenated responses to an out-of-band collector at safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo11. Runs automatically on `npm install`. The tarball also ships a `postinstall.js` containing a `getSSHKeys()` function that enumerates `~/.ssh` and POSTs a JSON payload with the directory listing, username, and platform to a hardcoded remote IP 124.221.154.135:443/post over HTTPS. The advertised purpose (`formatDate()` in index.js) is a thin cover story unrelated to the shipped install-time behavior.
Affected packages
Package
Name: simple-date-formatter-new-7
Purl: pkg:npm/simple-date-formatter-new-7
Affected ranges
Type: N/A
Events:
