MAL-2026-12205

    Dashboard / Malicious Package / MAL-2026-12205

    MAL-2026-12205

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in simple-date-formatter-util-4 (npm)

    Details: Source: amazon-inspector (f6ec6c790f702e0bb6617bb6bf16ad8b3a154bc7d539938535cde7a2cf205f17) The package's npm postinstall script curls cloud instance-metadata endpoints (AWS 169.254.169.254, Alibaba 100.100.100.200, Tencent metadata.tencentyun.com and 169.254.0.23), retrieves the AWS IAM security-credentials for the attached instance role, lists /data/, and POSTs the collected output to a hardcoded attacker-controlled interact.sh (OAST) subdomain at ycrqyyjhwepdmhjifyccxss1hrks8lcd2.oast.fun. A bundled postinstall.js additionally reads the installer's ~/.ssh directory and POSTs username, platform, and key-file listings via HTTPS to the hardcoded IP 124.221.154.135:443/post. The declared package purpose (date formatting utility) has no relationship to cloud metadata queries or SSH-directory enumeration. Running `npm install` on this package hands short-lived IAM credentials and SSH material to the attacker.

    References: https://www.npmjs.com/package/simple-date-formatter-util-4/v/1.0.1, https://www.npmjs.com/package/simple-date-formatter-util-4/v/1.0.0

    Affected packages

    Package

    Name: simple-date-formatter-util-4

    Purl: pkg:npm/simple-date-formatter-util-4

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.0