MAL-2026-12204

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-util-16/MAL-2026-12204.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12204
Published
2026-08-05T08:48:40Z
Modified
2026-08-05T10:06:22.099207214Z
Summary
Malicious code in simple-date-formatter-util-16 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3d57172cd3c0a47afc03e1a15ca2ead758bb6f5c78a2234d42487d65cb4944c5)

package.json declares a postinstall script that runs automatically on npm install. The script creates a block-device node for the host disk (mknod /tmp/vda2 b 252 2), mounts it read-only at /tmp/hostroot, reads the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token, collects host and pod metadata (/etc/kubernetes, ARP table, internal work directories), and POSTs the aggregated output via curl to http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo4. The behavior combines container-escape reconnaissance against a Kubernetes node with credential and host-data exfiltration to an out-of-band interaction domain.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T08:48:40Z",
            "source": "amazon-inspector",
            "sha256": "3d57172cd3c0a47afc03e1a15ca2ead758bb6f5c78a2234d42487d65cb4944c5",
            "import_time": "2026-08-05T09:28:09.747074366Z",
            "id": "IN-MAL-2026-014426",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / simple-date-formatter-util-16

Package

Name
simple-date-formatter-util-16
View open source insights on deps.dev
Purl
pkg:npm/simple-date-formatter-util-16

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "simple-date-formatter-util-16-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-WOuKpKDsAoAy/QrLZA+PPYF+KpbYxATNxwPs9iGiAKfcpVl+l1YnrLfCG4Gk/WY5p39WKw84BG7Y+Bxn7/vz1g==",
                "sha1": "fc7642256a7bef50573cb64d083a8fc07f77b438"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "6a11ce41f6508e735acdc9a42c170348b9c2a80f1a1a3d0ce5c7a638a19c6f2c479f47",
            "sha256": "47eea575378c410807b0712bea4bed05c140f1b8c3d33bc78a73e3dcadb7c5e6",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-date-formatter-util-16/MAL-2026-12204.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]