MAL-2026-14032

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/datefmt-simple-utils/MAL-2026-14032.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14032
Published
2026-08-14T14:12:16Z
Modified
2026-08-14T14:46:35.970623876Z
Summary
Malicious code in datefmt-simple-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9)

datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fires automatically on npm install. postinstall.js connects a TCP socket to the hardcoded remote host 8.135.48.40 on port 4444 and attaches an interactive /bin/bash to that socket, giving the remote endpoint full command execution on the installer's machine. Three fallback techniques target the same host: a python3 pty.spawn reverse shell, a python3 subprocess-based variant, and a Node net.connect + spawn('/bin/bash', ['-i']) variant. The advertised date-formatting purpose is a cover story; no such functionality is wired into the install-time code path.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "modified_time": "2026-08-14T14:12:16Z",
            "id": "IN-MAL-2026-017761",
            "sha256": "7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9",
            "source": "amazon-inspector",
            "import_time": "2026-08-14T14:28:06.920717477Z"
        }
    ]
}
References
Credits

Affected packages

npm / datefmt-simple-utils

Package

Name
datefmt-simple-utils
View open source insights on deps.dev
Purl
pkg:npm/datefmt-simple-utils

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-3lDhMYy83As355DKdPRaD0APBJJKEScq29htTVOdCXaJAxiYPsbOmh3f0eIS1StW254JWH/f3Kl7aYU1rqjsVQ==",
                "sha1": "dadc78d7daa895de15157a9a7c5f41148a9188cb"
            },
            "filename": "datefmt-simple-utils-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "tlsh": "f911edf553ebe238efba20b4786e906336a393032782dad8341e47019f535540c92ae1",
            "sha256": "26fcaa78b7a6707b39d80122863ca90e2e7d39302810c1c209f9a1e0f327cff3"
        },
        {
            "path": "package.json",
            "tlsh": "15e0c23a9d415e336bf887a95e274606fa109f1f12284c0b71bb214c47a36b284ae309",
            "sha256": "00ea7a5dcd2f2ea9453b35fbc75c1085231caa34ba22cb7d2edfd9398da465ad"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/datefmt-simple-utils/MAL-2026-14032.json"