MAL-2026-11998

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-util-7/MAL-2026-11998.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11998
Published
2026-08-04T23:54:53Z
Modified
2026-08-05T00:38:04.768979340Z
Summary
Malicious code in simple-date-formatter-util-7 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e53aca949f6ef9820b220363a2b0c7df91e36f08ded73165dfe9140a004fd693)

Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script that spawns an interactive bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving a remote party command execution on the installer's host immediately after npm install. A bundled postinstall.js additionally enumerates the installer's ~/.ssh directory and POSTs the listing along with username and platform metadata to the same host at 124.221.154.135 over HTTPS. Advertised purpose (date formatting) does not require network access, shell execution, or SSH directory reads.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-04T23:54:53Z",
            "sha256": "e53aca949f6ef9820b220363a2b0c7df91e36f08ded73165dfe9140a004fd693",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-011354",
            "import_time": "2026-08-05T00:04:38.224189221Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / simple-date-formatter-util-7

Package

Name
simple-date-formatter-util-7
View open source insights on deps.dev
Purl
pkg:npm/simple-date-formatter-util-7

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-NfwVkmOhoHyfYfnNVdCPncTn+VEDDwTOYpPyL93LwdkFPlU6hkJ3osJjwlXvapH5XpzLGzG9yg2UYJviakwWRw==",
                "sha1": "6e3c9e2de26c5ea1fe12e349b843f58b09b1c7ef"
            },
            "filename": "simple-date-formatter-util-7-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "eb655ea0f2d70694600b00fa56b21a70fba19eaa4cc7115f79ae084c62c91d59",
            "path": "package.json",
            "tlsh": "18e07d50ce108c3367d585b99a568512bb04de1b04183c09779b2249a3dfa7344fc30e"
        },
        {
            "sha256": "f2be6940c08d36a7f1ce83d5fe16fefd8c14edda5d124e0f6406725beb5020ef",
            "path": "postinstall.js",
            "tlsh": "273165d558f9cd3007778685639b91263102fe13650ee940f3c807a51fe9a5449f2dee"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-util-7/MAL-2026-11998.json"