MAL-2026-12202

    Dashboard / Malicious Package / MAL-2026-12202

    MAL-2026-12202

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in simple-date-formatter-util-13 (npm)

    Details: Source: amazon-inspector (fe9863d2e47d22ca16f42efd68d0c79e0b2730b48984bf68b040f6f920fb70ec) Package presents itself as a date-formatting utility (index.js is a four-line toLocaleDateString wrapper) but its package.json postinstall hook runs an inline shell pipeline that reads /proc/self/status, /dev, /home/work, /wenchain, and /etc/hosts, probes internal Kubernetes API endpoints, and POSTs the collected output to an attacker-controlled Interactsh OAST endpoint at safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo2. The tarball also ships postinstall.js, which enumerates the installer's ~/.ssh directory, gathers filenames plus username and platform, and POSTs the JSON payload over HTTPS to the hardcoded IP 124.221.154.135. Both behaviors auto-execute on npm install.

    References: https://www.npmjs.com/package/simple-date-formatter-util-13/v/1.0.0

    Affected packages

    Package

    Name: simple-date-formatter-util-13

    Purl: pkg:npm/simple-date-formatter-util-13

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-12202 | CVE-DB