MAL-2026-13978

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/datefmt-util-helper/MAL-2026-13978.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13978
Published
2026-08-13T21:09:09Z
Modified
2026-08-13T21:30:25.638238209Z
Summary
Malicious code in datefmt-util-helper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb)

Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node postinstall.js'; postinstall.js hardcodes VPS = '8.135.48.40' and PORT = 4444 and runs execSync of a python3 -c payload that opens a socket to that host and invokes pty.spawn('/bin/bash'), with fallback branches using python3 subprocess and a Node net + child_process.spawn('/bin/bash') chain. Runs automatically during npm install, giving the remote host full interactive shell control on the installer's machine as the installing user. index.js implements a trivial date formatter as cover (a source comment translates to 'disguised as a normal date-formatting tool'); the library surface exists only to legitimize the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017689",
            "import_time": "2026-08-13T21:20:57.812087859Z",
            "sha256": "54bb325784300096be6f67b12ea982f2f0ea239013b2ac86779b4fd485636da4",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-13T21:09:09Z"
        },
        {
            "id": "IN-MAL-2026-017690",
            "import_time": "2026-08-13T21:20:57.842640494Z",
            "sha256": "d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-13T21:09:18Z"
        }
    ]
}
References
Credits

Affected packages

npm / datefmt-util-helper

Package

Name
datefmt-util-helper
View open source insights on deps.dev
Purl
pkg:npm/datefmt-util-helper

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "tlsh": "f911edf553ebe238efba20b4786e906336a393032782dad8341e47019f535540c92ae1",
            "sha256": "26fcaa78b7a6707b39d80122863ca90e2e7d39302810c1c209f9a1e0f327cff3"
        },
        {
            "path": "index.js",
            "tlsh": "e8f028d168e62841632b70ad06870b5599a4f5032d1bf5f1bf0d4d184fcca4da25f7e4",
            "sha256": "47d5ef560237b5f8f4c08060ea19a3d340d5ea848828a793ac696ec493cf93f3"
        }
    ],
    "package_integrity": [
        {
            "filename": "datefmt-util-helper-1.0.1.tgz",
            "hashes": {
                "sha1": "45781677a34c9cd86a95d17e20213591d446da0b",
                "sha512_sri": "sha512-BuR9NxxiYX29nEzBd/Xsifg2epWqmr84nG2Yq53ZBp73mmB1oSISSsQo/UHspR+C6oYTb9edL9kM23V8EM7S1w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/datefmt-util-helper/MAL-2026-13978.json"