MAL-2026-13978

Dashboard / Malicious Package / MAL-2026-13978

MAL-2026-13978

Summary: Malicious code in datefmt-util-helper (npm)

Details: Source: amazon-inspector (d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb) Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node postinstall.js'; postinstall.js hardcodes VPS = '8.135.48.40' and PORT = 4444 and runs execSync of a python3 -c payload that opens a socket to that host and invokes pty.spawn('/bin/bash'), with fallback branches using python3 subprocess and a Node net + child_process.spawn('/bin/bash') chain. Runs automatically during `npm install`, giving the remote host full interactive shell control on the installer's machine as the installing user. index.js implements a trivial date formatter as cover (a source comment translates to 'disguised as a normal date-formatting tool'); the library surface exists only to legitimize the package.

References: https://www.npmjs.com/package/datefmt-util-helper/v/1.0.1, https://www.npmjs.com/package/datefmt-util-helper/v/1.0.0