MAL-2026-11099

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/demo-awesome-date-parser-test/MAL-2026-11099.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11099
Aliases
  • GHSA-xcf3-mw56-cqm5
Published
2026-07-27T15:47:01Z
Modified
2026-08-05T07:21:08Z
Summary
Malicious code in demo-awesome-date-parser-test (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e5cccf4c1379e6c3f9af7dde45277b1c4db552a0ad878bc08378ad6e8879b497)

The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoParseDate function invokes injectScriptIfNeeded, which registers a jQuery form-submission handler that reads submitted form field values, stores them in localStorage under keys 'sendToUnload_secretData' and 'sendToUnload_secretDataBase64', and POSTs them via fetch to a URL built from location.host with the path '/leak?data_stolen_on_unload_base64='. A window unload handler additionally exfiltrates the buffered values twice via navigator.sendBeacon to the same '/leak?...' path. injectScriptIfNeeded also loads remote JavaScript by evaluating a dynamic import of '/tag_added_via_script_import.js' and by appending a

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "GHSA-xcf3-mw56-cqm5",
            "import_time": "2026-07-28T02:02:27.993581Z",
            "modified_time": "2026-07-27T15:47:02Z",
            "sha256": "6e554422e7b097902e753eb63c772c66845f3f19bf0c2974f6fbeb9fe441ec34",
            "source": "ghsa-malware",
            "versions": [
                "0.0.7",
                "0.0.6",
                "0.0.5",
                "0.0.4",
                "0.0.3",
                "0.0.2",
                "0.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-010904",
            "import_time": "2026-07-28T14:19:58.375637961Z",
            "modified_time": "2026-07-28T13:34:09Z",
            "sha256": "78f9d8522a52a8a7b511febd77ca55d74649d44804ca0da0dc4832646adb632d",
            "source": "amazon-inspector",
            "versions": [
                "0.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-010897",
            "import_time": "2026-07-28T14:19:58.055884309Z",
            "modified_time": "2026-07-28T13:33:15Z",
            "sha256": "c46165721d6b575d475d3af67d3de1320285aa30f802144c08bd7bc574e2f06b",
            "source": "amazon-inspector",
            "versions": [
                "0.0.6"
            ]
        },
        {
            "id": "IN-MAL-2026-010899",
            "import_time": "2026-07-28T14:19:58.144605939Z",
            "modified_time": "2026-07-28T13:33:30Z",
            "sha256": "3dac7edbd7a941a69901501e2f602b37a483dde93aac9af9270f146fea0e7992",
            "source": "amazon-inspector",
            "versions": [
                "0.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-011071",
            "import_time": "2026-08-04T21:33:15.821184786Z",
            "modified_time": "2026-08-04T21:28:19Z",
            "sha256": "e5cccf4c1379e6c3f9af7dde45277b1c4db552a0ad878bc08378ad6e8879b497",
            "source": "amazon-inspector",
            "versions": [
                "0.0.7"
            ]
        },
        {
            "id": "IN-MAL-2026-011119",
            "import_time": "2026-08-04T22:30:00.167646531Z",
            "modified_time": "2026-08-04T21:35:19Z",
            "sha256": "291bd1d754bffc6d57f45f76cbdd6abb09da6cd53d84982a99b8eb6689dd5794",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-011185",
            "import_time": "2026-08-04T22:30:03.808315405Z",
            "modified_time": "2026-08-04T21:44:48Z",
            "sha256": "a9192adc99bd98d23c6c4c8cc43dd10047a3d4b99f1d236b2937b0fd121830b9",
            "source": "amazon-inspector",
            "versions": [
                "0.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-013345",
            "import_time": "2026-08-05T07:06:42.480884573Z",
            "modified_time": "2026-08-05T06:10:00Z",
            "sha256": "4e126cd9ddc6434c9a1ffad2d290c78c1c46b92db48916fca78458f7a276e06d",
            "source": "amazon-inspector",
            "versions": [
                "0.0.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / demo-awesome-date-parser-test

Package

Name
demo-awesome-date-parser-test
View open source insights on deps.dev
Purl
pkg:npm/demo-awesome-date-parser-test

Affected ranges

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "sha256": "2f871dcfc70d4f65ad9453b7b65f5343bf019142d5003a16ef7fe12c1ebe588c",
            "tlsh": "5bd3df81a6905ea2989fa53b9d92ed7dc01e4e3215341e8ec5033baa655331fb5f2c33"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/demo-awesome-date-parser-test/MAL-2026-11099.json"