MAL-2026-13697

    Dashboard / Malicious Package / MAL-2026-13697

    MAL-2026-13697

    Published: 10 Aug 2026Last Modified: 10 Aug 2026

    Summary: Malicious code in simple-date-formatter-new-10 (npm)

    Details: Source: amazon-inspector (c1cc0707c5a58067075648ef1c040ceeb07c2550b9f06d53b5c8c41ec167c841) [email protected] presents itself as a trivial date-formatting utility but ships two attack payloads that fire when npm installs the package. The package.json postinstall script opens an interactive bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving the publisher remote command execution on the installer's host. A bundled postinstall.js reads the installer's ~/.ssh directory and POSTs its contents together with username and platform to https://124.221.154.135/post, the same C2 endpoint. The advertised date-formatting API (index.js exporting formatDate) is a cover story for the reverse-shell and SSH-key-theft payloads.

    References: https://www.npmjs.com/package/simple-date-formatter-new-10/v/1.0.0

    Affected packages

    Package

    Name: simple-date-formatter-new-10

    Purl: pkg:npm/simple-date-formatter-new-10

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-13697 | CVE-DB