MAL-2026-12175

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/datefmt-pro/MAL-2026-12175.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12175
Published
2026-08-05T09:10:03Z
Modified
2026-08-05T14:36:17.437973524Z
Summary
Malicious code in datefmt-pro (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787)

datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall entry runs postinstall.js on npm install, which uses child_process.execSync to run hostname, whoami, uname -a, and pwd, and calls os.networkInterfaces() to enumerate non-internal IPv4 addresses. It then POSTs the collected identity and internal network information as JSON over plain HTTP to the hardcoded bare-IP endpoint http://129.204.76.212:9999/rce-poc. index.js contains only a trivial date-formatting stub whose in-source comments state it exists to make the package look like a real date library while the payload lives in postinstall.js. The package name imitates a plausible utility to attract installers via typo/trust; the advertised purpose does not require any host reconnaissance or outbound network activity at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "dbb14f65bcc614fa6337db8dbdb57db7586f3d2897de9165b73ba3b98675e263",
            "id": "IN-MAL-2026-014573",
            "modified_time": "2026-08-05T09:10:03Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:28:26.872589487Z",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "sha256": "6019431ae57e04e7ec9eb38009d7feb179e15a6aa7d88c14e384ae04ae3ef7b8",
            "id": "IN-MAL-2026-014972",
            "modified_time": "2026-08-05T13:19:18Z",
            "import_time": "2026-08-05T14:19:48.182934465Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "sha256": "addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787",
            "id": "IN-MAL-2026-014976",
            "modified_time": "2026-08-05T13:26:50Z",
            "import_time": "2026-08-05T14:19:48.551784531Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / datefmt-pro

Package

Name
datefmt-pro
View open source insights on deps.dev
Purl
pkg:npm/datefmt-pro

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "a896ce5c59c66d4dec329d2ee47acab75329631507f218e05f4a61cc361d457a",
            "path": "postinstall.js",
            "tlsh": "fc4166b300f993a028662895150ba5113325c0133a19fdd0bbdd03988fcab2ca773bad"
        },
        {
            "sha256": "567034ef246b79b079f0f1157a727f62c335da947246527696d54725a1c608a2",
            "path": "package.json",
            "tlsh": "7ee06838c9309e372dc40a5a4d56c4077f150c1708487c0433a7515c475e67b80bf30d"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-ciHq7tILbN6YKPPNDpXy4mj7RxWAb6t21dEqkJZT0pfdoBntqUfc8zFA4R3TM9ghoXymLWbtPxUatcOe9FFx7A==",
                "sha1": "6907c8ec4f1e0d6b602ab7692422a7614bdbabdd"
            },
            "filename": "datefmt-pro-1.0.2.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/datefmt-pro/MAL-2026-12175.json"