MAL-2026-6301

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/date-format-helper2/MAL-2026-6301.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6301
Aliases
  • GHSA-j29f-62x7-hj66
Published
2026-06-23T15:21:06Z
Modified
2026-06-24T15:31:25.453037467Z
Summary
Malicious code in date-format-helper2 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (66c1775ce65ad47476ee1a0f1c7c5373e61466ec3eb4543cc658e67d2de22960)

Package is advertised as a React date-formatting utility, but its postinstall.js performs targeted credential harvesting on npm install. The script reads Coze workload identity environment variables (COZEWORKLOADAPITOKEN, COZEWORKLOADIDENTITYCLIENTID, COZEWORKLOADIDENTITYCLIENTSECRET, COZEWORKLOADIDENTITYTOKENENDPOINT, COZEPROJECTSPACEID), uses them to mint OAuth access tokens via three grant types (client_credentials, token-exchange, and a JSON body variant) against the configured token endpoint, enumerates ~30 Coze API paths against api.coze.cn / integration.coze.cn / api.coze.com using the minted tokens, and POSTs the env values, the issued tokens, and the API responses over plaintext HTTP to http://2e3bkumw.requestrepo.com — a public request-capture sinkhole controlled by the attacker. The advertised date-helper functionality in index.js is unrelated cover for the install-time credential theft. An installer running npm install in CI or a developer environment with Coze credentials in scope would have their workload identity stolen and the attacker could impersonate that workload against Coze APIs.

Source: ghsa-malware (a13b8fd2717f710497955f390bdf36a5b52abda37b7f3bd47f737f98bfbbb5b4)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "04a1e5571acbf5901d113811c19983d13f2dc0d532127445c2b16ed650d6b57c",
            "import_time": "2026-06-23T15:33:52.792961423Z",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T15:21:06Z",
            "versions": [
                "1.0.3"
            ],
            "id": "IN-MAL-2026-007227"
        },
        {
            "sha256": "66c1775ce65ad47476ee1a0f1c7c5373e61466ec3eb4543cc658e67d2de22960",
            "import_time": "2026-06-23T15:33:52.85396594Z",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T15:21:08Z",
            "versions": [
                "1.0.7"
            ],
            "id": "IN-MAL-2026-007229"
        },
        {
            "sha256": "78c0b87795b33cc06d2aa096cca532f61aa0f600ec888be07b7bcfc2ea1c6cad",
            "import_time": "2026-06-23T15:33:52.924070985Z",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T15:21:09Z",
            "versions": [
                "1.0.6"
            ],
            "id": "IN-MAL-2026-007230"
        },
        {
            "sha256": "ac54599f5ebf64585175c7d4b7bd626097f248c04aca277737e457940bd46373",
            "import_time": "2026-06-23T15:33:53.001988804Z",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T15:21:10Z",
            "versions": [
                "1.0.2"
            ],
            "id": "IN-MAL-2026-007231"
        },
        {
            "sha256": "bd77add56411d8c62f428c859ce630c4604640766bb7eb3b359426d782737d5b",
            "import_time": "2026-06-23T15:33:52.823855715Z",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T15:21:07Z",
            "versions": [
                "1.0.4"
            ],
            "id": "IN-MAL-2026-007228"
        },
        {
            "sha256": "d8b44f47c55950a88fb3842670fa061aa6b9c08cb3f048e0f43bfc4be2789009",
            "id": "IN-MAL-2026-007233",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T15:21:16Z",
            "versions": [
                "1.0.5"
            ],
            "import_time": "2026-06-23T15:33:53.21488354Z"
        },
        {
            "sha256": "f1d638ba3203a606c5e4dd2187aed12eae58a0e3144b6df61d6495182dd27654",
            "id": "IN-MAL-2026-007232",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T15:21:11Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-06-23T15:33:53.112890562Z"
        },
        {
            "sha256": "a13b8fd2717f710497955f390bdf36a5b52abda37b7f3bd47f737f98bfbbb5b4",
            "import_time": "2026-06-24T15:13:19.717029109Z",
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "modified_time": "2026-06-24T14:08:09Z",
            "id": "GHSA-j29f-62x7-hj66",
            "source": "ghsa-malware"
        }
    ]
}
References
Credits

Affected packages

npm / date-format-helper2

Package

Name
date-format-helper2
View open source insights on deps.dev
Purl
pkg:npm/date-format-helper2

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/date-format-helper2/MAL-2026-6301.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "62eed992097a9541850b5481c81dd74cb6fa73bfaa901b50fd075fccdd6fbe21",
            "tlsh": "ac8196f3bbbddc30366bb5b1334b20422e9bde5e0285bd50f184a4a4a20d3982373965",
            "path": "postinstall.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "date-format-helper2-1.0.3.tgz",
            "hashes": {
                "sha1": "595ace5abaf471804f56b3f798f06d9ab0a6e860",
                "sha512_sri": "sha512-N+sOdUTNDpwn7jPdmAhdI5BxhXN8feSKcdfMrg4/ZqVvNH9qx02+U/XTCgR3MnrfDP+EwZEtTRBoLHiGGdnBWg=="
            }
        }
    ]
}