MAL-2026-14032

    Dashboard / Malicious Package / MAL-2026-14032

    MAL-2026-14032

    Published: 14 Aug 2026Last Modified: 14 Aug 2026

    Summary: Malicious code in datefmt-simple-utils (npm)

    Details: Source: amazon-inspector (7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9) datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fires automatically on npm install. postinstall.js connects a TCP socket to the hardcoded remote host 8.135.48.40 on port 4444 and attaches an interactive /bin/bash to that socket, giving the remote endpoint full command execution on the installer's machine. Three fallback techniques target the same host: a python3 pty.spawn reverse shell, a python3 subprocess-based variant, and a Node net.connect + spawn('/bin/bash', ['-i']) variant. The advertised date-formatting purpose is a cover story; no such functionality is wired into the install-time code path.

    References: https://www.npmjs.com/package/datefmt-simple-utils/v/1.0.0

    Affected packages

    Package

    Name: datefmt-simple-utils

    Purl: pkg:npm/datefmt-simple-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0